setup_Ir5swQ3ApecKw7XBUxXE[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

setup_Ir5swQ3ApecKw7XBUxXE.exe
Size

115.5MB
MD5

3c903811e0374569ba62c9d2ecc7f1cd
SHA1

27a8a03d9635bfff7de5b4d4f3f2e881c05248b6
SHA256

a3baf9ead6dd149dadd33ff57f8ee0d1e897137f9b28c2db44771b9e9339c462
SHA512

9de26884fe56a0b5d34a91f66aa136f10b90b5942dc27ed893283c86abb3d11a0a4394fd9346d390d1d1813a978c7c38c16fe630d07f3b4606b24c1b8d1d5c30
SSDEEP

3145728:Rt7k6MQcMUepKyOPHpm57svrQmOZkg7Tsz7no1Z59ExQmfCmvJbmYVa:XkBQcM+DPpSAvruZNlfQxLCmxqP

Score

3^/10

Malware Config

Signatures

Unsigned PE 234 IoCs

Checks for missing Authenticode signature.

resource
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsExec.dll
unpack001/plugins/7z/7z.dll
unpack001/plugins/7z/7z.exe
unpack001/plugins/NSecUI/7z.dll
unpack001/plugins/NSecUI/AxWebServer.dll
unpack001/plugins/NSecUI/ICSharpCode.SharpZipLib.dll
unpack001/plugins/NSecUI/JsonFx.dll
unpack001/plugins/NSecUI/MailKit.dll
unpack001/plugins/NSecUI/MimeKit.dll
unpack001/plugins/NSecUI/MsgReader.dll
unpack001/plugins/NSecUI/NSDesPack.dll
unpack001/plugins/NSecUI/NSEC.Common.dll
unpack001/plugins/NSecUI/NSEC.Util.dll
unpack001/plugins/NSecUI/NSecUI.AppStore.Client.dll
unpack001/plugins/NSecUI/NSecUI.Core.dll
unpack001/plugins/NSecUI/NSecUI.Info.dll
unpack001/plugins/NSecUI/NSecsoft.NativeModule.dll
unpack001/plugins/NSecUI/NSecsoft.Ping32.DocSec.API.Core.dll
unpack001/plugins/NSecUI/Nx.UI.Client.Approval.dll
unpack001/plugins/NSecUI/Nx.UI.Client.Common.dll
unpack001/plugins/NSecUI/Nx.UI.Client.Resource.dll
unpack001/plugins/NSecUI/Nx.UI.Toolset.Watermark.dll
unpack001/plugins/NSecUI/Nx.UI.WorkOrderMessage.dll
unpack001/plugins/NSecUI/OpenMcdf.dll
unpack001/plugins/NSecUI/RestSharp.dll
unpack001/plugins/NSecUI/RtfPipe.dll
unpack001/plugins/NSecUI/WinDiskMgr.dll
unpack001/plugins/NSecUI/XOR.API.Doc.dll
unpack001/plugins/NSecUI/XOR.API.WMI.dll
unpack001/plugins/NSecUI/en/NSec.ScanFile.resources.dll
unpack001/plugins/NSecUI/en/NSecUI.AppStore.resources.dll
unpack001/plugins/NSecUI/en/NSecUI.Info.resources.dll
unpack001/plugins/NSecUI/en/NSecUI.Popup.resources.dll
unpack001/plugins/NSecUI/en/NSecUI.resources.dll
unpack001/plugins/NSecUI/en/Nx.UI.Client.Approval.resources.dll
unpack001/plugins/NSecUI/en/Nx.UI.Client.Common.resources.dll
unpack001/plugins/NSecUI/en/Nx.UI.Client.Resource.resources.dll
unpack001/plugins/NSecUI/en/Nx.UI.MessageCenter.resources.dll
unpack001/plugins/NSecUI/en/Nx.UI.SupportTicket.resources.dll
unpack001/plugins/NSecUI/en/Nx.UI.Toolset.FileMaker.resources.dll
unpack001/plugins/NSecUI/en/Nx.UI.Toolset.Watermark.resources.dll
unpack001/plugins/NSecUI/en/Nx.UI.WorkOrderMessage.resources.dll
unpack001/plugins/NSecUI/x64/NSecsoft.NativeModule.dll
unpack001/plugins/NSecUI/x64/sqlite3.dll
unpack001/plugins/NSecUI/x86/NSecsoft.NativeModule.dll
unpack001/plugins/NSecUI/x86/sqlite3.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Blazor.Reporting.v22.1.Viewer.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Blazor.RichEdit.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Blazor.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Charts.Designer.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Dashboard.v22.1.Core.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Dashboard.v22.1.Web.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Dashboard.v22.1.Win.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Data.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.DataAccess.v22.1.UI.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.DataAccess.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Diagram.v22.1.Core.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Dialogs.v22.1.Core.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.EntityFrameworkCore.Security.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.AuditTrail.Xpo.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Blazor.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Chart.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.CloneObject.Xpo.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Dashboards.Web.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Dashboards.Win.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Dashboards.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.FileAttachment.Blazor.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.FileAttachment.Web.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.FileAttachment.Win.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.HtmlPropertyEditor.Win.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Kpi.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Maps.Web.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Notifications.Web.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Notifications.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Objects.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Office.Web.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Office.Win.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.PivotChart.Web.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.PivotChart.Win.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.PivotChart.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.PivotGrid.Web.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.PivotGrid.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Reports.Web.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Reports.Win.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Reports.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.ReportsV2.Blazor.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.ReportsV2.Web.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.ReportsV2.Win.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.ReportsV2.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Scheduler.Web.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Scheduler.Win.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Scheduler.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.ScriptRecorder.Win.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.ScriptRecorder.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Security.Xpo.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Security.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.StateMachine.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Validation.Win.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Validation.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.ViewVariantsModule.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Web.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Win.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Workflow.Win.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Workflow.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Map.v22.1.Core.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Mvvm.v22.1.DataModel.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Office.v22.1.Core.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Pdf.v22.1.Core.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Persistent.Base.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.PivotGrid.v22.1.Core.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Printing.v22.1.Core.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.ReportServer.v22.1.Localization.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.RichEdit.v22.1.Core.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Snap.v22.1.Core.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Snap.v22.1.Extensions.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Snap.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Sparkline.v22.1.Core.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Spreadsheet.v22.1.Core.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Utils.v22.1.UI.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Utils.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Web.ASPxDiagram.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Web.ASPxGantt.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Web.ASPxHtmlEditor.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Web.ASPxRichEdit.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Web.ASPxScheduler.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Web.ASPxSpellChecker.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Web.ASPxSpreadsheet.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Web.ASPxTreeList.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Web.Resources.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Web.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.Charts.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.CodeView.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.Controls.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.Core.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.Docking.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.DocumentViewer.v22.1.Core.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.Gantt.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.Gauges.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.Grid.v22.1.Core.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.LayoutControl.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.NavBar.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.PdfViewer.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.Printing.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.PropertyGrid.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.ReportDesigner.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.Ribbon.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.RichEdit.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.Scheduler.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.Scheduling.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.SpellChecker.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpf.Spreadsheet.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.Xpo.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraBars.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraCharts.v22.1.Wizard.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraCharts.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraEditors.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraGantt.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraGauges.v22.1.Core.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraGauges.v22.1.Presets.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraGrid.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraLayout.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraNavBar.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraPdfViewer.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraPivotGrid.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraPrinting.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraReports.v22.1.Extensions.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraReports.v22.1.Web.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraReports.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraRichEdit.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraScheduler.v22.1.Core.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraScheduler.v22.1.Extensions.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraScheduler.v22.1.Reporting.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraScheduler.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraSpellChecker.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraSpreadsheet.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraTreeList.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraVerticalGrid.v22.1.resources.dll
unpack001/plugins/NSecUI/zh-Hans/DevExpress.XtraWizard.v22.1.resources.dll
unpack001/plugins/RD/NSecRD.exe
unpack001/plugins/nsis/Bin/GenPat.exe
unpack001/plugins/nsis/Bin/MakeLangId.exe
unpack001/plugins/nsis/Bin/RegTool-x86.bin
unpack001/plugins/nsis/Bin/makensis.exe
unpack001/plugins/nsis/Bin/zip2exe.exe
unpack001/plugins/nsis/Bin/zlib1.dll
unpack001/plugins/nsis/Plugins/x86-ansi/Banner.dll
unpack001/plugins/nsis/Plugins/x86-ansi/BgImage.dll
unpack001/plugins/nsis/Plugins/x86-ansi/Dialer.dll
unpack001/plugins/nsis/Plugins/x86-ansi/InstallOptions.dll
unpack001/plugins/nsis/Plugins/x86-ansi/LangDLL.dll
unpack001/plugins/nsis/Plugins/x86-ansi/Math.dll
unpack001/plugins/nsis/Plugins/x86-ansi/StartMenu.dll
unpack001/plugins/nsis/Plugins/x86-ansi/System.dll
unpack001/plugins/nsis/Plugins/x86-ansi/TypeLib.dll
unpack001/plugins/nsis/Plugins/x86-ansi/UserInfo.dll
unpack001/plugins/nsis/Plugins/x86-ansi/VPatch.dll
unpack001/plugins/nsis/Plugins/x86-ansi/advsplash.dll
unpack001/plugins/nsis/Plugins/x86-ansi/nsDialogs.dll
unpack001/plugins/nsis/Plugins/x86-ansi/nsExec.dll
unpack001/plugins/nsis/Plugins/x86-ansi/nsisdl.dll
unpack001/plugins/nsis/Plugins/x86-ansi/splash.dll
unpack001/plugins/nsis/Plugins/x86-unicode/Banner.dll
unpack001/plugins/nsis/Plugins/x86-unicode/BgImage.dll
unpack001/plugins/nsis/Plugins/x86-unicode/Dialer.dll
unpack001/plugins/nsis/Plugins/x86-unicode/InstallOptions.dll
unpack001/plugins/nsis/Plugins/x86-unicode/LangDLL.dll
unpack001/plugins/nsis/Plugins/x86-unicode/Math.dll
unpack001/plugins/nsis/Plugins/x86-unicode/StartMenu.dll
unpack001/plugins/nsis/Plugins/x86-unicode/System.dll
unpack001/plugins/nsis/Plugins/x86-unicode/TypeLib.dll
unpack001/plugins/nsis/Plugins/x86-unicode/UserInfo.dll
unpack001/plugins/nsis/Plugins/x86-unicode/VPatch.dll
unpack001/plugins/nsis/Plugins/x86-unicode/advsplash.dll
unpack001/plugins/nsis/Plugins/x86-unicode/nsDialogs.dll
unpack001/plugins/nsis/Plugins/x86-unicode/nsExec.dll
unpack001/plugins/nsis/Plugins/x86-unicode/nsisdl.dll
unpack001/plugins/nsis/Plugins/x86-unicode/splash.dll
unpack001/plugins/nsis/Stubs/bzip2-x86-ansi
unpack001/plugins/nsis/Stubs/bzip2-x86-unicode
unpack001/plugins/nsis/Stubs/bzip2_solid-x86-ansi
unpack001/plugins/nsis/Stubs/bzip2_solid-x86-unicode
unpack001/plugins/nsis/Stubs/lzma-x86-ansi
unpack001/plugins/nsis/Stubs/lzma-x86-unicode
unpack001/plugins/nsis/Stubs/lzma_solid-x86-ansi
unpack001/plugins/nsis/Stubs/lzma_solid-x86-unicode
unpack001/plugins/nsis/Stubs/zlib-x86-ansi
unpack001/plugins/nsis/Stubs/zlib-x86-unicode
unpack001/plugins/nsis/Stubs/zlib_solid-x86-ansi
unpack001/plugins/nsis/Stubs/zlib_solid-x86-unicode
unpack001/plugins/nsis/makensis.exe
unpack001/plugins/xphelper/normaliz.dll

NSIS installer 6 IoCs

installer

resource	yara_rule
static1/unpack001/plugins/nsis/Stubs/bzip2-x86-ansi	nsis_installer_2
static1/unpack001/plugins/nsis/Stubs/bzip2_solid-x86-ansi	nsis_installer_2
static1/unpack001/plugins/nsis/Stubs/lzma-x86-ansi	nsis_installer_2
static1/unpack001/plugins/nsis/Stubs/lzma_solid-x86-ansi	nsis_installer_2
static1/unpack001/plugins/nsis/Stubs/zlib-x86-ansi	nsis_installer_2
static1/unpack001/plugins/nsis/Stubs/zlib_solid-x86-ansi	nsis_installer_2

Files

setup_Ir5swQ3ApecKw7XBUxXE.exe
.exe windows:4 windows x86 arch:x86

61259b55b8912888e90f516ca08dc514

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5b:5a:5b:1a:c4:09:3e:49:e8:f0:91:15:6a:7b:1a:b7:d8:da:50:8f:7f:f2:a2:99:6b:70:b0:54:81:d1:fa:7b
Signer

Actual PE Digest

5b:5a:5b:1a:c4:09:3e:49:e8:f0:91:15:6a:7b:1a:b7:d8:da:50:8f:7f:f2:a2:99:6b:70:b0:54:81:d1:fa:7b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 80KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 267KB - Virtual size: 266KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

4b45b7e00344a87332fbd12653854d1a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentDirectoryW
GlobalUnlock
GlobalLock
GetModuleHandleW
CloseHandle
SetEndOfFile
SetCurrentDirectoryW
GetPrivateProfileStringW
GetPrivateProfileIntW
MultiByteToWideChar
ReadFile
GetFileSize
CreateFileW
lstrcmpiW
lstrcatW
lstrcpynW
WritePrivateProfileStringW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc
WriteFile
SetFilePointer

user32

LoadCursorW
SetWindowRgn
GetDlgCtrlID
CloseClipboard
DrawFocusRect
OpenClipboard
DrawTextW
SetCursor
LoadIconW
LoadImageW
SetWindowLongW
CreateWindowExW
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamW
GetClientRect
ShowWindow
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
CallWindowProcW
PostMessageW
MessageBoxW
GetSysColor
CharNextW
wsprintfW
GetWindowTextW
SetWindowTextW
SendMessageW
GetWindowLongW
EnableMenuItem
PtInRect
MapWindowPoints
GetClipboardData

gdi32

SetTextColor
DeleteObject
CombineRgn
CreateRectRgn
GetDIBits
SelectObject
CreateCompatibleDC
GetObjectW

shell32

SHGetDesktopFolder
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW

comdlg32

GetOpenFileNameW
GetSaveFileNameW
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
make_unicode
show

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfW

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 662B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/ioSpecial.ini
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsExec.dll
.dll windows:4 windows x86 arch:x86

c1c7505e1e6e929ebb6b9100e55b050a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
IsTextUnicode

user32

wsprintfW
CharNextExA
SendMessageW
FindWindowExW
CharNextW
CharPrevW

kernel32

CreatePipe
DeleteFileW
lstrcmpiW
GetCommandLineW
ExitProcess
Sleep
TerminateProcess
GlobalReAlloc
MultiByteToWideChar
IsDBCSLeadByteEx
ReadFile
PeekNamedPipe
GetExitCodeProcess
WaitForSingleObject
GetTickCount
lstrcpyW
CreateProcessW
GetStartupInfoW
CreateFileMappingW
GetVersion
GetCurrentProcess
lstrcpynW
lstrlenW
lstrcatW
CloseHandle
UnmapViewOfFile
MapViewOfFile
GlobalFree
CreateFileW
CopyFileW
GetTempFileNameW
GlobalAlloc
GetModuleFileNameW
GetProcAddress
GetModuleHandleA

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
7zr.exe
.exe windows:4 windows x86 arch:x86

68328ca48472a0100f01c70ee51b6d07

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

75:2e:2e:f9:2b:c4:bb:5e:a1:b5:e3:da:a3:1d:57:59
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

14/10/2016, 00:00

Not After

27/09/2017, 23:59

Subject

CN=NSecsoft(Jinan) Co.\, Ltd.,OU=Development Team,O=NSecsoft(Jinan) Co.\, Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

91:bd:56:d3:df:ac:02:c9:00:ae:cf:57:7b:32:0a:ae:cf:ba:be:89:61:8e:63:ac:79:76:59:61:57:a8:ce:bb
Signer

Actual PE Digest

91:bd:56:d3:df:ac:02:c9:00:ae:cf:57:7b:32:0a:ae:cf:ba:be:89:61:8e:63:ac:79:76:59:61:57:a8:ce:bb

Digest Algorithm

sha256

PE Digest Matches

true

91:bd:56:d3:df:ac:02:c9:00:ae:cf:57:7b:32:0a:ae:cf:ba:be:89:61:8e:63:ac:79:76:59:61:57:a8:ce:bb
Signer

Actual PE Digest

91:bd:56:d3:df:ac:02:c9:00:ae:cf:57:7b:32:0a:ae:cf:ba:be:89:61:8e:63:ac:79:76:59:61:57:a8:ce:bb

Digest Algorithm

sha256

PE Digest Matches

true

91:bd:56:d3:df:ac:02:c9:00:ae:cf:57:7b:32:0a:ae:cf:ba:be:89:61:8e:63:ac:79:76:59:61:57:a8:ce:bb
Signer

Actual PE Digest

91:bd:56:d3:df:ac:02:c9:00:ae:cf:57:7b:32:0a:ae:cf:ba:be:89:61:8e:63:ac:79:76:59:61:57:a8:ce:bb

Digest Algorithm

sha256

PE Digest Matches

true

a5:50:9e:be:e0:d2:28:5e:37:19:03:8e:78:65:2b:ef:8e:c4:b9:df
Signer

Actual PE Digest

a5:50:9e:be:e0:d2:28:5e:37:19:03:8e:78:65:2b:ef:8e:c4:b9:df

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

VariantCopy
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantClear

user32

CharUpperW

advapi32

SetFileSecurityW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
GetFileSecurityW

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_beginthreadex
realloc
strlen
memset
wcscmp
wcsstr
strcmp
memmove
fputs
fputc
fflush
fgetc
fclose
_iob
free
_CxxThrowException
malloc
memcmp
_purecall
memcpy
__CxxFrameHandler
_isatty
_fileno

kernel32

ResetEvent
CreateSemaphoreW
CreateEventW
WaitForSingleObject
ReleaseSemaphore
InitializeCriticalSection
VirtualAlloc
SetEvent
SetFileTime
QueryPerformanceCounter
SetConsoleMode
GetConsoleMode
GetVersionExW
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
FileTimeToLocalFileTime
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetProcessTimes
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetProcessAffinityMask
WaitForMultipleObjects
GetStdHandle
GetSystemTimeAsFileTime
FileTimeToDosDateTime
GlobalMemoryStatus
GetSystemInfo
FileTimeToSystemTime
CompareFileTime
GetCurrentProcess
GetFileInformationByHandle
DeviceIoControl
SetEndOfFile
WriteFile
ReadFile
SetFilePointer
GetFileSize
GetLogicalDriveStringsW
GetFileAttributesW
GetModuleHandleA
FindNextFileW
FindFirstFileW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
FindClose
CreateFileW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
DeleteFileW
SetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
VirtualFree

Sections

.text
Size: 381KB - Virtual size: 381KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
DcFormat.exe
.exe windows:5 windows x86 arch:x86

8105b6667bced8fa6a8265edb1156444

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:73:52:94:cc:d4:a2:bc:58:49:28:45:7f:e7:2c:62
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/03/2020, 00:00

Not After

22/03/2021, 12:00

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,POSTALCODE=250101,STREET=高新区新泺大街2008号银荷大厦C座606,L=Jinan,ST=Shandong,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13054a696e616e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:5b:27:84:03:2c:07:b5:e6:3d:bb:a7:be:59:71:0d
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/04/2020, 00:00

Not After

22/03/2021, 12:00

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,POSTALCODE=250101,STREET=高新区新泺大街2008号银荷大厦C座606,L=Jinan,ST=Shandong,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13054a696e616e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

86:9c:9c:09:4f:f8:b6:79:ae:d0:a1:50:90:09:c7:de:27:99:d9:e1:49:04:53:f2:a8:5f:ed:7b:f9:bf:65:e0
Signer

Actual PE Digest

86:9c:9c:09:4f:f8:b6:79:ae:d0:a1:50:90:09:c7:de:27:99:d9:e1:49:04:53:f2:a8:5f:ed:7b:f9:bf:65:e0

Digest Algorithm

sha256

PE Digest Matches

true

86:9c:9c:09:4f:f8:b6:79:ae:d0:a1:50:90:09:c7:de:27:99:d9:e1:49:04:53:f2:a8:5f:ed:7b:f9:bf:65:e0
Signer

Actual PE Digest

86:9c:9c:09:4f:f8:b6:79:ae:d0:a1:50:90:09:c7:de:27:99:d9:e1:49:04:53:f2:a8:5f:ed:7b:f9:bf:65:e0

Digest Algorithm

sha256

PE Digest Matches

true

86:9c:9c:09:4f:f8:b6:79:ae:d0:a1:50:90:09:c7:de:27:99:d9:e1:49:04:53:f2:a8:5f:ed:7b:f9:bf:65:e0
Signer

Actual PE Digest

86:9c:9c:09:4f:f8:b6:79:ae:d0:a1:50:90:09:c7:de:27:99:d9:e1:49:04:53:f2:a8:5f:ed:7b:f9:bf:65:e0

Digest Algorithm

sha256

PE Digest Matches

true

86:9c:9c:09:4f:f8:b6:79:ae:d0:a1:50:90:09:c7:de:27:99:d9:e1:49:04:53:f2:a8:5f:ed:7b:f9:bf:65:e0
Signer

Actual PE Digest

86:9c:9c:09:4f:f8:b6:79:ae:d0:a1:50:90:09:c7:de:27:99:d9:e1:49:04:53:f2:a8:5f:ed:7b:f9:bf:65:e0

Digest Algorithm

sha256

PE Digest Matches

true

c9:08:73:5f:e5:06:d1:84:dc:e8:72:8f:40:cc:27:14:86:f4:e2:09
Signer

Actual PE Digest

c9:08:73:5f:e5:06:d1:84:dc:e8:72:8f:40:cc:27:14:86:f4:e2:09

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\DcFormat.pdb

Imports

kernel32

GetSystemInfo
EnterCriticalSection
OutputDebugStringA
GetCurrentDirectoryW
RemoveDirectoryW
LoadLibraryW
SetCurrentDirectoryW
SetErrorMode
SetFilePointer
GetWindowsDirectoryW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
CreateThread
InterlockedExchangeAdd
InterlockedExchange
SetEvent
ResetEvent
CreateEventW
SetFileValidData
SetEndOfFile
DeleteVolumeMountPointW
GetFileAttributesExW
GetStartupInfoW
GetProcessWorkingSetSize
GetProcessTimes
GetThreadTimes
GlobalMemoryStatus
SetFileAttributesW
GetFileType
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentProcessId
GetProcessHeap
HeapAlloc
HeapFree
OpenProcess
TerminateProcess
GetLogicalDrives
lstrlenW
GetFileAttributesW
FindResourceW
LoadResource
SizeofResource
LockResource
GetLocalTime
SetFileAttributesA
GetSystemDirectoryA
InterlockedCompareExchange
SetEnvironmentVariableA
CompareStringW
IsValidLocale
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetTimeZoneInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
PeekNamedPipe
GetFullPathNameW
CreateFileA
WriteConsoleW
HeapSize
GetStringTypeW
HeapCreate
LCMapStringW
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
SetHandleCount
GetLocaleInfoW
GetStdHandle
IsProcessorFeaturePresent
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
HeapReAlloc
HeapSetInformation
FindFirstFileExW
FileTimeToLocalFileTime
FileTimeToSystemTime
GetConsoleMode
GetConsoleCP
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetSystemTimeAsFileTime
ResumeThread
ExitThread
EncodePointer
DecodePointer
RtlUnwind
RaiseException
LoadLibraryA
LocalAlloc
GetCurrentProcess
GetFileSize
FlushFileBuffers
LeaveCriticalSection
GetVersionExW
OpenMutexW
CreateMutexW
ReleaseMutex
SetUnhandledExceptionFilter
GetCurrentThread
WaitForSingleObject
UnhandledExceptionFilter
GlobalLock
GlobalUnlock
FormatMessageW
FreeLibrary
DeleteCriticalSection
InitializeCriticalSection
GetCommandLineW
LocalFree
GetDriveTypeW
GetTempPathW
GetTempFileNameW
FindFirstVolumeW
QueryDosDeviceW
FindNextVolumeW
FindVolumeClose
MoveFileExW
GetShortPathNameW
GetPrivateProfileStringW
WritePrivateProfileStringW
CreateDirectoryW
SetFirmwareEnvironmentVariableW
GetProcAddress
GetModuleHandleW
GetSystemDirectoryW
GetFirmwareEnvironmentVariableW
DeleteFileW
CopyFileW
ExitProcess
DefineDosDeviceW
GetVolumeNameForVolumeMountPointW
SetVolumeMountPointW
GetTickCount
GetModuleFileNameW
GetDiskFreeSpaceW
InterlockedIncrement
GetVolumePathNameW
GetDiskFreeSpaceExW
SetThreadExecutionState
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameA
GetFileSizeEx
SetFileTime
GetFileTime
GetFileInformationByHandle
FindFirstFileW
FindNextFileW
GetVolumeInformationW
CreateFileW
CloseHandle
FindClose
ReadFile
WriteFile
Sleep
VirtualLock
SetFilePointerEx
GetLastError
VirtualUnlock
DeviceIoControl
SetLastError
SetProcessShutdownParameters
GetCurrentThreadId
InterlockedDecrement

user32

GetCursorPos
GetCaretPos
GetQueueStatus
GetProcessWindowStation
GetOpenClipboardWindow
GetMessageTime
GetMessagePos
GetInputState
GetFocus
GetDesktopWindow
GetClipboardViewer
PostThreadMessageW
DispatchMessageW
TranslateMessage
GetMessageW
SetWindowTextW
PostMessageW
GetWindowTextW
GetWindowLongW
EnumWindows
SendMessageW
GetDlgItem
EnableWindow
PeekMessageW
SetFocus
MessageBoxW
EndDialog
wsprintfA
IsWindow
GetParent
GetClipboardOwner
GetCapture
SetWindowsHookExW
CallNextHookEx
SetTimer
MessageBeep
DialogBoxParamW
GetSysColorBrush
GetDlgItemTextW
IsWindowEnabled
UnhookWindowsHookEx
RegisterWindowMessageW
CreateDesktopW
GetClassInfoW
GetWindowTextLengthW
SetDlgItemTextW
LoadKeyboardLayoutW
GetKeyboardLayout
ShowWindow
MoveWindow
MapDialogRect
CreateDialogParamW
SystemParametersInfoW
AppendMenuW
SendMessageTimeoutW
TrackMouseEvent
GetShellWindow
GetThreadDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationW
CloseDesktop
SwitchDesktop
IsWindowVisible
RegisterClassExW
CreateWindowExW
SetLayeredWindowAttributes
ExitWindowsEx
SendDlgItemMessageW
GetForegroundWindow
GetWindowThreadProcessId
SetForegroundWindow
GetKeyState
EnumChildWindows
GetDlgCtrlID
GetClassNameW
LoadCursorW
SetCursor
DefDlgProcW
UnregisterClassW
LoadIconW
RegisterClassW
GetUpdateRect
BeginPaint
DefWindowProcW
GetDialogBaseUnits
EndPaint
LoadBitmapW
OpenClipboard
GetClipboardData
CloseClipboard
VkKeyScanW
SetWindowLongW
CallWindowProcW
GetSystemMenu
EnableMenuItem
GetClientRect
GetSystemMetrics
GetWindowInfo
SetWindowPos
InvalidateRect
GetDC
ReleaseDC
MessageBoxA
GetActiveWindow
KillTimer
GetAsyncKeyState
DestroyWindow
GetWindowRect

gdi32

CreateCompatibleDC
SetMapMode
GetDeviceCaps
SelectObject
GetTextExtentPoint32W
CreateFontIndirectW
BitBlt
DeleteDC
StretchBlt
SetStretchBltMode
CreateCompatibleBitmap
GetObjectW
GetCurrentObject
LineTo
MoveToEx
CreatePen
GetStockObject
SetBkMode
SetTextColor
DeleteObject
GetTextMetricsW

comdlg32

GetSaveFileNameW
GetOpenFileNameW

advapi32

IsValidSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityInfo
RegQueryValueExW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
CreateServiceW
ChangeServiceConfig2W
StartServiceW
ControlService
DeleteService
RegOpenKeyExW
RegQueryValueExA
RegSetValueExA
ChangeServiceConfigW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
RegCloseKey
CloseServiceHandle
CryptAcquireContextW
CryptGenRandom
CryptReleaseContext
GetSecurityInfo
RegDeleteValueW
IsWellKnownSid
ConvertSidToStringSidW
RegCreateKeyExW
RegSetValueExW
RegDeleteKeyW
GetTokenInformation
RevertToSelf
DuplicateTokenEx
SetThreadToken
OpenThreadToken
ImpersonateSelf

shell32

SHGetFolderPathW
CommandLineToArgvW
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetMalloc
ord680
SHFileOperationW
SHGetFileInfoW
SHChangeNotify
SHGetSpecialFolderLocation
DragFinish
ShellExecuteW
DragAcceptFiles
SHCreateDirectoryExA
DragQueryFileW

ole32

CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoGetObject
CoInitialize
CoUninitialize
CoRegisterClassObject
CoRevokeClassObject

oleaut32

SysAllocString
SysAllocStringByteLen
SysFreeString
SysStringByteLen
SysAllocStringLen

shlwapi

wvnsprintfA
PathFindFileNameA
SHSetValueA
wnsprintfA
StrStrIW
wnsprintfW
PathFindFileNameW

comctl32

ord17

setupapi

SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW

Exports

Exports

GetVolumeDevices
IsDeviceMounted

Sections

.text
Size: 930KB - Virtual size: 929KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 486KB - Virtual size: 485KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 32KB - Virtual size: 379KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.4MB - Virtual size: 5.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DcMount.dll
.dll windows:5 windows x86 arch:x86

1885a039fe52827f4d44bd10edcd17cc

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cc:fd:4a:78:c1:98:71:4a:ee:e4:51:88:d8:cb:cb:3d:eb:a4:6a:36:c3:ba:ca:40:df:70:70:4c:41:b3:55:a4
Signer

Actual PE Digest

cc:fd:4a:78:c1:98:71:4a:ee:e4:51:88:d8:cb:cb:3d:eb:a4:6a:36:c3:ba:ca:40:df:70:70:4c:41:b3:55:a4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\DcMount.pdb

Imports

kernel32

ResetEvent
GetFileAttributesExW
GetStartupInfoW
SetFileAttributesW
GetFileType
OpenProcess
GetProcessHeap
HeapFree
HeapAlloc
VirtualUnlock
GetVolumePathNameW
GetVolumeInformationW
MoveFileExW
GetTempPathW
GetModuleHandleW
DeleteCriticalSection
RaiseException
GetShortPathNameW
DecodePointer
WideCharToMultiByte
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
VirtualLock
FindFirstFileExA
HeapSize
HeapReAlloc
WriteConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
ReadConsoleW
GetStdHandle
GetConsoleMode
GetConsoleCP
GetModuleHandleExW
ExitProcess
InterlockedFlushSList
RtlUnwind
LoadLibraryExW
SetEndOfFile
GetLocalTime
SetFileAttributesA
GetSystemDirectoryA
CreateFileA
GetModuleFileNameA
GetCPInfo
GetLocaleInfoW
LCMapStringW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
EncodePointer
GetStringTypeW
InitializeSListHead
GetSystemTimeAsFileTime
IsDebuggerPresent
WaitForSingleObjectEx
IsProcessorFeaturePresent
LoadLibraryExA
VirtualQuery
VirtualProtect
GetVersionExW
QueryPerformanceCounter
GetFileAttributesW
GetDiskFreeSpaceW
TerminateProcess
FindFirstFileW
CreateFileW
CreateDirectoryW
GetSystemDirectoryW
GetCommandLineW
GetCommandLineA
CreateEventW
CreateMutexW
OutputDebugStringW
OutputDebugStringA
FormatMessageW
FlushFileBuffers
GetFileSize
GetLogicalDrives
ReleaseMutex
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCurrentProcessId
SetStdHandle
GetCurrentProcess
GetTickCount
GetSystemInfo
CloseHandle
FindClose
GetLastError
SetFilePointerEx
ReadFile
WriteFile
GetFileSizeEx
Sleep
SetEvent
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LocalFree
GetProcAddress
FreeLibrary
InitializeCriticalSectionAndSpinCount
GetCurrentThreadId
FindVolumeClose
FindNextVolumeW
FindFirstVolumeW
DeleteFileW
QueryDosDeviceW
DeviceIoControl
GetModuleFileNameW
FindNextFileA

user32

MessageBoxW
SendMessageW
GetDlgItem
LoadCursorW
SetCursor
wsprintfA
DispatchMessageW
SendMessageTimeoutW
PeekMessageW
MessageBoxA
GetActiveWindow
GetWindowTextW
SetForegroundWindow
RegisterWindowMessageW

advapi32

RegOpenKeyExW
GetTokenInformation
OpenProcessToken
StartServiceW
QueryServiceStatus
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
ChangeServiceConfigW
RegSetValueExA
RegQueryValueExA
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegQueryValueExW
RegSetValueExW
ConvertSidToStringSidW

shell32

ord680
SHCreateDirectoryExA
SHChangeNotify
SHGetFolderPathW
ShellExecuteW

ole32

CoInitialize
CoGetObject
StringFromGUID2
CoCreateInstance
CoUninitialize

oleaut32

SysStringByteLen
SysAllocStringByteLen
SysFreeString
VariantClear
SysAllocString

shlwapi

StrStrIW
wnsprintfA
wnsprintfW
wvnsprintfA
SHSetValueA
PathFindFileNameA

setupapi

SetupDiGetClassDevsW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiDestroyDeviceInfoList

Exports

Exports

DriverAttach
GetVolumeDevices
NSBroadcastDeviceChange
NSGetMountedVolumeDriveNo
NSInit
NSIsMountedVolume
NSMountVolume
NSOpenDevice
NSUnmountVolume

Sections

.text
Size: 343KB - Virtual size: 343KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 319KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 364KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5.3MB - Virtual size: 5.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Desa32.dll
.dll windows:5 windows x86 arch:x86

bc0555b1f4b39815fa6b238ecbfbea4a

Code Sign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

99:ca:1a:d6:db:08:ea:03:93:0f:a9:19:43:46:6b:0d:0b:a9:5f:09:ce:e5:92:65:d5:83:5a:1b:c0:02:4f:03
Signer

Actual PE Digest

99:ca:1a:d6:db:08:ea:03:93:0f:a9:19:43:46:6b:0d:0b:a9:5f:09:ce:e5:92:65:d5:83:5a:1b:c0:02:4f:03

Digest Algorithm

sha256

PE Digest Matches

true

99:ca:1a:d6:db:08:ea:03:93:0f:a9:19:43:46:6b:0d:0b:a9:5f:09:ce:e5:92:65:d5:83:5a:1b:c0:02:4f:03
Signer

Actual PE Digest

99:ca:1a:d6:db:08:ea:03:93:0f:a9:19:43:46:6b:0d:0b:a9:5f:09:ce:e5:92:65:d5:83:5a:1b:c0:02:4f:03

Digest Algorithm

sha256

PE Digest Matches

true

99:ca:1a:d6:db:08:ea:03:93:0f:a9:19:43:46:6b:0d:0b:a9:5f:09:ce:e5:92:65:d5:83:5a:1b:c0:02:4f:03
Signer

Actual PE Digest

99:ca:1a:d6:db:08:ea:03:93:0f:a9:19:43:46:6b:0d:0b:a9:5f:09:ce:e5:92:65:d5:83:5a:1b:c0:02:4f:03

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\Desa32.pdb

Imports

advapi32

OpenServiceW
StartServiceW
OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
CreateServiceW
RegCreateKeyW
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
RegCloseKey
AdjustTokenPrivileges
LookupPrivilegeValueW

kernel32

QueryDosDeviceW
EnterCriticalSection
GetLongPathNameW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetLogicalDriveStringsW
GetLastError
OutputDebugStringW
CreateThread
DeleteCriticalSection
Sleep
GetCurrentProcess
DeviceIoControl
CreateFileW
CloseHandle
GetProcAddress
GetModuleHandleW
DecodePointer
SetEndOfFile
HeapReAlloc
HeapSize
WriteConsoleW
SetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedFlushSList
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ReadFile
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
GetACP
GetStdHandle
GetFileType
GetStringTypeW
SetFilePointerEx
GetConsoleMode
ReadConsoleW
LCMapStringW
FlushFileBuffers
WriteFile
GetConsoleCP
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
RaiseException

user32

MessageBoxW
DefWindowProcW
DestroyWindow
CreateWindowExW
DispatchMessageW
RegisterClassW
TranslateMessage
PostThreadMessageW
PostQuitMessage
GetMessageW

ntdll

NtClose
RtlInitUnicodeString
NtQuerySymbolicLinkObject
NtOpenSymbolicLinkObject

shlwapi

PathIsNetworkPathW

Exports

Exports

SefsAddNewPolicy
SefsCloseModule
SefsConvert2KernelName
SefsDelAllPolicys
SefsDeletePolicy
SefsExportPolicy2File
SefsGetDosFilePath
SefsGetGlobalAccessFlag
SefsGetPolicy
SefsGetPolicyIndexsValue
SefsGetPolicysCount
SefsGlobalNameCleanup
SefsGlobalNameDel
SefsGlobalNameDump
SefsGlobalNameGetAll
SefsGlobalNameSet
SefsImportPolicyFromFile
SefsIsNameInExpression
SefsOpenModule
SefsPolicyAddPathName
SefsPolicyDelAllPathName
SefsPolicyDelPathName
SefsPolicyFileCheckSum
SefsPolicyGetAllPathName
SefsSecuProcGetStatus
SefsSecuProcListAdd
SefsSecuProcListCheck
SefsSecuProcListCheckEx
SefsSecuProcListCleanup
SefsSecuProcListDel
SefsSecuProcListGetCount
SefsSecuProcListGetPids
SefsSecuProcSetStatus
SefsSetGlobalAccessFlag
SefsSetPolciyNotiyCallback
SefsSetPolicy
SefsSetPrivilege
SetRegistrationKey

Sections

.text
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Desh32.dll
.dll windows:5 windows x86 arch:x86

3110520a03b76be64c1fa9b53b27e2c2

Code Sign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

97:ce:c1:53:96:25:3f:13:f6:a2:97:5e:60:00:3d:cc:f1:22:44:2c:4d:ee:31:3f:a3:8c:e6:3a:c2:f2:3b:7a
Signer

Actual PE Digest

97:ce:c1:53:96:25:3f:13:f6:a2:97:5e:60:00:3d:cc:f1:22:44:2c:4d:ee:31:3f:a3:8c:e6:3a:c2:f2:3b:7a

Digest Algorithm

sha256

PE Digest Matches

true

97:ce:c1:53:96:25:3f:13:f6:a2:97:5e:60:00:3d:cc:f1:22:44:2c:4d:ee:31:3f:a3:8c:e6:3a:c2:f2:3b:7a
Signer

Actual PE Digest

97:ce:c1:53:96:25:3f:13:f6:a2:97:5e:60:00:3d:cc:f1:22:44:2c:4d:ee:31:3f:a3:8c:e6:3a:c2:f2:3b:7a

Digest Algorithm

sha256

PE Digest Matches

true

97:ce:c1:53:96:25:3f:13:f6:a2:97:5e:60:00:3d:cc:f1:22:44:2c:4d:ee:31:3f:a3:8c:e6:3a:c2:f2:3b:7a
Signer

Actual PE Digest

97:ce:c1:53:96:25:3f:13:f6:a2:97:5e:60:00:3d:cc:f1:22:44:2c:4d:ee:31:3f:a3:8c:e6:3a:c2:f2:3b:7a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\Desh32.pdb

Imports

kernel32

CancelIo
QueryDosDeviceW
GetSystemDirectoryA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteFile
SetFileTime
SetFilePointer
SetEndOfFile
WaitForSingleObject
SetFileAttributesW
CreateEventW
GetFileInformationByHandle
GetLastError
DeleteFileW
SetFilePointerEx
MoveFileExW
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetSystemTime
FlushFileBuffers
GetModuleFileNameA
SetLastError
OutputDebugStringA
CreateFileA
GetLocalTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LocalFree
OpenMutexW
GetTickCount
HeapFree
SetFileAttributesA
GetProcessHeap
Sleep
GetDriveTypeW
FormatMessageA
DeleteCriticalSection
VerSetConditionMask
SleepEx
VerifyVersionInfoA
FreeLibrary
GetProcAddress
WaitForMultipleObjects
GetFileType
GetStdHandle
PeekNamedPipe
LoadLibraryA
EncodePointer
InterlockedFlushSList
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
CreateThread
ExitThread
FreeLibraryAndExitThread
FileTimeToSystemTime
GetConsoleMode
ReadConsoleW
GetACP
GetStringTypeW
CompareStringW
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
HeapReAlloc
GetConsoleCP
SetStdHandle
GetCurrentDirectoryW
GetFullPathNameW
HeapSize
WriteConsoleW
GetTimeZoneInformation
DecodePointer
OpenProcess
RaiseException
CloseHandle
CreateFileW
GetFileSizeEx
HeapAlloc
ReadFile

shlwapi

PathAddBackslashW
StrToIntExA
SHSetValueA
PathGetDriveNumberW
PathIsRootW
PathFindExtensionW
PathIsDirectoryW
wnsprintfW
PathFindFileNameA
wvnsprintfA
wnsprintfA

sfc

SfcIsFileProtected

ws2_32

getaddrinfo
WSAIoctl
setsockopt
ntohs
getsockopt
getsockname
getpeername
bind
send
recv
WSASetLastError
freeaddrinfo
accept
listen
recvfrom
sendto
ioctlsocket
select
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
gethostname
closesocket
inet_addr
socket
connect
htons
WSAGetOverlappedResult
WSARecv
WSASend

wldap32

ord32
ord27
ord26
ord22
ord33
ord50
ord60
ord211
ord46
ord143
ord79
ord30
ord200
ord301
ord41
ord35

user32

wsprintfA

advapi32

RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
ConvertSidToStringSidW
RegQueryValueExW
GetTokenInformation
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptEncrypt
CryptImportKey
CryptGetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextA
RegCloseKey

shell32

SHCreateDirectoryExA

Exports

Exports

DES_DecryptFile
DES_EncryptFile
DES_IsEncryptedFile
DES_IsKeyMached

Sections

.text
Size: 309KB - Virtual size: 309KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
DtCore32.dll
.dll windows:5 windows x86 arch:x86

65ac82702dfd0aebd6f540034e6068a6

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:ed:c5:50:70:3d:19:ec:b9:15:37:8c:41:b0:c8:30:01:fd:25:65:57:ad:56:29:6e:a1:93:c9:fe:01:9d:1d
Signer

Actual PE Digest

d7:ed:c5:50:70:3d:19:ec:b9:15:37:8c:41:b0:c8:30:01:fd:25:65:57:ad:56:29:6e:a1:93:c9:fe:01:9d:1d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\DtCore32.pdb

Imports

kernel32

DeleteCriticalSection
TlsAlloc
DisableThreadLibraryCalls
TerminateThread
LoadLibraryW
DeviceIoControl
SystemTimeToTzSpecificLocalTime
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
CompareFileTime
TlsGetValue
TlsSetValue
GetBinaryTypeW
MoveFileExW
GetFileAttributesExW
SetFileAttributesW
CreateFileW
ReadFile
InterlockedIncrement
SleepEx
QueueUserAPC
InterlockedDecrement
GlobalUnlock
GetTickCount
GlobalLock
DeleteFileW
TlsFree
MoveFileWithProgressW
CopyFileExW
lstrlenW
OutputDebugStringA
GetExitCodeThread
VirtualFreeEx
GetSystemDirectoryW
CopyFileW
Process32FirstW
QueueUserWorkItem
Process32NextW
GetDriveTypeW
GetCurrentProcessId
LocalFree
ResetEvent
SetEvent
Sleep
CreateEventW
OpenEventW
GetVolumeInformationA
QueryDosDeviceA
InitializeCriticalSection
GetLogicalDrives
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
LoadLibraryExW
FreeLibrary
GetModuleHandleW
GetProcAddress
CreateFileMappingW
GetFileSize
UnmapViewOfFile
SetFilePointer
WriteFile
VirtualQuery
SetThreadContext
FlushInstructionCache
GetThreadContext
GetCurrentThread
SuspendThread
GetCurrentThreadId
VirtualAlloc
InterlockedCompareExchange
GetCurrentProcess
VirtualFree
VirtualProtect
GetExitCodeProcess
VirtualQueryEx
IsWow64Process
CreateProcessW
ReadProcessMemory
ExitProcess
VirtualAllocEx
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetComputerNameW
SetFilePointerEx
GetCurrentDirectoryW
CreateFileA
GetModuleHandleA
CreateDirectoryW
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
SetConsoleCtrlHandler
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
ReadConsoleW
GetFileAttributesW
GetTempPathW
GetConsoleMode
GetACP
WriteConsoleW
GetFileType
GetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
InterlockedFlushSList
RaiseException
RtlUnwind
GetSystemDirectoryA
GetFileSizeEx
GetLogicalDriveStringsW
VirtualProtectEx
CloseHandle
GetLastError
OpenProcess
ResumeThread
WaitForSingleObject
GetEnvironmentVariableA
GetEnvironmentVariableW
TerminateProcess
SetLastError
LocalAlloc
FindClose
RemoveDirectoryW
lstrcpynW
FindNextFileW
FindFirstFileW
QueryDosDeviceW
ReleaseMutex
GetModuleFileNameA
FileTimeToSystemTime
FlushFileBuffers
FormatMessageA
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
SwitchToThread
OpenFileMappingW
GetLocalTime
MapViewOfFile
CreateMutexW
OpenMutexW
HeapFree
GetDriveTypeA
HeapAlloc
SetFileAttributesA
GetProcessHeap
GetPrivateProfileStringA
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetVersionExW
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
GetVersionExA
DeleteFileA
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
SystemTimeToFileTime
GetSystemTime
WriteProcessMemory

user32

GetUserObjectInformationW
wsprintfA
CharUpperW
GetPropW
wsprintfW
GetWindowDC
PostMessageW
IsWindowVisible
EnumThreadWindows
GetDC
FindWindowW
ReleaseDC
GetMessageW
DispatchMessageA
CallNextHookEx
IsWindow
UnhookWindowsHookEx
DefWindowProcA
CreateWindowExA
TranslateMessage
LoadIconW
LoadCursorW
SetWindowsHookExW
PostQuitMessage
RegisterClassExA
UpdateWindow
GetMenuItemInfoW
InsertMenuItemW
GetMenuItemCount
GetProcessWindowStation
MessageBoxW
TrackPopupMenu
SetMenuItemInfoW
EnableMenuItem
DdeGetData
EnumWindows
RealGetWindowClassA
GetClipboardData
mouse_event
GetSystemMetrics
FillRect
SetWindowLongW
GetWindowTextA
DdeAccessData
GetWindowLongW
GetWindowThreadProcessId
SetClipboardData
EnumChildWindows
SendMessageW
GetWindowTextW

gdi32

StretchBlt
Ellipse
GetObjectW
GetStockObject
BitBlt
SelectObject
CreateCompatibleDC
GetDIBits
DeleteDC

advapi32

CryptGenRandom
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
OpenServiceW
RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
RegCloseKey
SetSecurityDescriptorDacl
GetTokenInformation
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExA
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
RegQueryValueExA
ConvertSidToStringSidA
SetFileSecurityW
CryptEnumProvidersW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptDecrypt

shell32

SHCreateDirectoryExA
SHCreateDirectoryExW
CommandLineToArgvW
SHFreeNameMappings
SHFileOperationW
ShellExecuteExW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
DragQueryFileW

ole32

CoCreateGuid
CoInitializeSecurity
ReleaseStgMedium
CoSetProxyBlanket
CoUninitialize
CoInitialize
OleFlushClipboard
OleGetClipboard
RegisterDragDrop
OleIsCurrentClipboard
OleSetClipboard
CoTaskMemFree
CoCreateInstance

shlwapi

PathFindFileNameW
wnsprintfA
StrStrIA
wnsprintfW
StrStrIW
SHGetValueW
PathRemoveExtensionW
PathAddExtensionW
PathFileExistsW
ord219
PathAppendW
PathFindExtensionW
PathIsNetworkPathW
PathIsDirectoryW
PathMatchSpecW
PathUnquoteSpacesW
StrStrW
PathAppendA
PathFileExistsA
SHSetValueA
SHSetValueW
SHDeleteValueA
PathAddBackslashW
StrToIntExA
PathFindFileNameA
wvnsprintfA

gdiplus

GdipAlloc
GdipGetImageEncoders
GdipCloneImage
GdipDisposeImage
GdipGetImageEncodersSize
GdipSaveImageToFile
GdipFree
GdiplusShutdown
GdipFillEllipseI
GdiplusStartup
GdipCreateBitmapFromFile

ws2_32

shutdown
getnameinfo
connect
closesocket
freeaddrinfo
ioctlsocket
sendto
recvfrom
getpeername
getaddrinfo
gethostname
inet_ntoa
gethostbyname
WSAGetLastError
setsockopt
htons
recv
socket
inet_addr
WSASetLastError
WSACreateEvent
WSACloseEvent
WSAIoctl
bind
send
WSAEnumNetworkEvents
WSAEventSelect
listen
getsockname
getsockopt
ntohs
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

crypt32

CertOpenStore
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenSystemStoreW

wldap32

ord142
ord219
ord46
ord14
ord216
ord208
ord41
ord117
ord301
ord147
ord133
ord79
ord145
ord167
ord127
ord27
ord26

Exports

Exports

InstallHook
LdrInjectDll
StartInjectQQOnX86
UnistallHook

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 636KB - Virtual size: 635KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sharedx
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fixit.exe
.exe windows:5 windows x86 arch:x86

7921ff62dbe05ef6acb22e2a1c30974e

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ea:cf:f8:a2:25:31:36:01:f1:cb:39:10:be:e5:d0:f3:81:cb:45:3e:5f:b6:77:ff:34:1c:dd:3c:e1:60:43:da
Signer

Actual PE Digest

ea:cf:f8:a2:25:31:36:01:f1:cb:39:10:be:e5:d0:f3:81:cb:45:3e:5f:b6:77:ff:34:1c:dd:3c:e1:60:43:da

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Release\Client\Fixit.pdb

Imports

kernel32

SystemTimeToTzSpecificLocalTime
GetCurrentDirectoryW
GetTickCount
GetCurrentProcessId
ResetEvent
SwitchToThread
ExitProcess
CloseHandle
GetLastError
Sleep
CreateMutexW
GetModuleFileNameW
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
QueryPerformanceFrequency
SleepEx
MoveFileExW
CreateDirectoryW
DecodePointer
GetTimeZoneInformation
GetConsoleCP
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetLogicalDrives
SetFileAttributesW
GetDriveTypeW
GetModuleFileNameA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
OpenFileMappingW
GetLocalTime
CreateFileMappingW
MapViewOfFile
ReadFile
WaitForSingleObject
GetSystemDirectoryW
LocalFree
CreateProcessW
OpenMutexW
WriteFile
MoveFileExA
CreateFileA
SetEvent
DeleteFileA
HeapFree
GetDriveTypeA
GetVolumeInformationA
HeapAlloc
SetFileAttributesA
GetComputerNameW
GetProcessHeap
GetPrivateProfileStringA
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LockFileEx
GetFileSize
DeleteCriticalSection
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTime
FormatMessageA
FlushFileBuffers
GetFileSizeEx
GetSystemDirectoryA
SetFilePointerEx
FindFirstFileW
SetLastError
FindNextFileW
DeviceIoControl
FindClose
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
CreateEventW
Process32NextW
FileTimeToSystemTime
Process32FirstW
LoadLibraryExW
WriteProcessMemory
VirtualProtect
MoveFileA
ResumeThread
CopyFileA
RtlUnwind
RaiseException
InterlockedPushEntrySList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetFileType
GetModuleHandleExW
WriteConsoleW
GetCommandLineA
GetCommandLineW
GetACP
CreateThread
ExitThread
FreeLibraryAndExitThread
GetConsoleMode
ReadConsoleW
GetStringTypeW
SetConsoleCtrlHandler
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetDateFormatW

shlwapi

StrStrIA
SHGetValueW
wvnsprintfA
StrCmpIW
SHSetValueA
SHSetValueW
wnsprintfA
StrToIntA
StrToIntExA
PathFindFileNameA
PathFileExistsW
PathFindFileNameW
PathFileExistsA
PathMatchSpecW
PathAppendA
StrCmpNIA
PathAppendW
wnsprintfW

ws2_32

inet_addr
socket
connect
WSAWaitForMultipleEvents
recv
htons
setsockopt
gethostname
gethostbyname
inet_ntoa
WSAStartup
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
recvfrom
sendto
WSASetLastError
WSACreateEvent
WSACloseEvent
WSACleanup
closesocket
WSAIoctl
bind
ntohs
send
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
getpeername
getsockname
WSAGetLastError
ioctlsocket
getnameinfo
shutdown
getsockopt
ntohl
freeaddrinfo

iphlpapi

GetAdaptersAddresses

crypt32

CertGetEnhancedKeyUsage
CertEnumCertificatesInStore
CertOpenSystemStoreW
CertGetIntendedKeyUsage
CertOpenStore
CertFindCertificateInStore
CertCloseStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertGetCertificateContextProperty

wldap32

ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145

netapi32

Netbios

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

dbghelp

MiniDumpWriteDump

user32

MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
wsprintfA

advapi32

OpenServiceW
RegOpenKeyExW
InitializeSecurityDescriptor
StartServiceW
SetEntriesInAclW
AllocateAndInitializeSid
OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
RegCloseKey
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ControlService
SetFileSecurityW
SetSecurityDescriptorDacl
GetTokenInformation
RegQueryValueExW
RegQueryValueExA
RegCreateKeyExW
ConvertSidToStringSidW
RegSetValueExW
OpenProcessToken
RegOpenKeyExA

shell32

ord165
SHCreateDirectoryExA
SHCreateDirectoryExW
SHGetSpecialFolderPathW

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 499KB - Virtual size: 498KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
ImageHelperEx.dll
.dll windows:6 windows x86 arch:x86

a32567569936d2f1ca0a77f65e87f9c7

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:8a:5d:01:78:75:cc:32:45:90:9a:63:7e:3c:56:e3:4d:85:8c:e1:9a:2d:13:1c:38:6d:b9:92:7f:fc:64:9a
Signer

Actual PE Digest

05:8a:5d:01:78:75:cc:32:45:90:9a:63:7e:3c:56:e3:4d:85:8c:e1:9a:2d:13:1c:38:6d:b9:92:7f:fc:64:9a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\ImageHelperEx.pdb

Imports

kernel32

TlsSetValue
InitializeCriticalSectionEx
GetLastError
TlsAlloc
DeleteFileW
RaiseException
DecodePointer
DeleteCriticalSection
TlsGetValue
TlsFree
WriteFile
CloseHandle
CreateFileW
GetStringTypeW
SetFilePointerEx
GetFileSizeEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
HeapSize
GetFileType
GetStdHandle
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InterlockedFlushSList
SetLastError
EncodePointer
InitializeCriticalSectionAndSpinCount
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
LCMapStringW
WriteConsoleW

user32

SetRect
IntersectRect
CopyRect
GetMonitorInfoW
OffsetRect
UnionRect
EqualRect

ole32

CoInitialize
CoCreateInstance

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

gdiplus

GdipCloneImage
GdiplusStartup
GdipDrawImageI
GdipCreateBitmapFromScan0
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipFree
GdipDisposeImage
GdipAlloc

Exports

Exports

CaptureScreenJPGEx

Sections

.text
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MessageCenter.exe
.exe windows:5 windows x86 arch:x86

9ebb92bdd9341c3cf99b31874c1b4508

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

20:e8:4b:13:d9:ba:a7:e1:32:33:d8:aa:ce:72:7f:cd:fa:8e:d6:72:a9:b2:a4:9c:8c:56:b1:01:39:ec:a2:6f
Signer

Actual PE Digest

20:e8:4b:13:d9:ba:a7:e1:32:33:d8:aa:ce:72:7f:cd:fa:8e:d6:72:a9:b2:a4:9c:8c:56:b1:01:39:ec:a2:6f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Release\Client\MessageCenter.pdb

Imports

kernel32

WriteConsoleW
GetACP
GetStdHandle
GetFileType
SetStdHandle
VirtualQuery
VirtualAlloc
QueryPerformanceFrequency
HeapQueryInformation
EnumSystemLocalesW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetCommandLineW
GetCommandLineA
InterlockedPushEntrySList
RtlUnwind
SetFilePointerEx
GetSystemDirectoryA
OpenProcess
DeviceIoControl
FindNextFileW
FormatMessageA
GetSystemTime
LockFileEx
CreateFileMappingA
HeapCompact
GetSystemInfo
GetVersionExA
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
ReadConsoleW
UnlockFileEx
GetFullPathNameA
InterlockedCompareExchange
HeapCreate
TryEnterCriticalSection
AreFileApisANSI
CreateMutexW
GetDriveTypeW
GetPrivateProfileStringA
GetComputerNameW
SetFileAttributesA
GetVolumeInformationA
GetDriveTypeA
GetLogicalDrives
MapViewOfFile
CreateFileMappingW
GetLocalTime
OpenFileMappingW
GetModuleFileNameA
DeleteFileA
CreateFileA
OutputDebugStringW
GetTimeZoneInformation
GetConsoleCP
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetConsoleCtrlHandler
SleepEx
MoveFileExW
CompareFileTime
GetEnvironmentVariableA
GetConsoleMode
GetDateFormatW
GetStringTypeW
GetTimeFormatW
LCMapStringW
UnmapViewOfFile
WaitForMultipleObjects
PeekNamedPipe
SetConsoleMode
ReadConsoleA
GetEnvironmentVariableW
HeapFree
InterlockedExchangeAdd
GetVersion
DeleteFiber
SwitchToFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GlobalMemoryStatus
CreateDirectoryW
SwitchToThread
GetStartupInfoW
IsValidLocale
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
GetUserDefaultLCID
GetTempFileNameW
GetDiskFreeSpaceW
SystemTimeToTzSpecificLocalTime
SetFileAttributesW
GetFileTime
GetFileSizeEx
GetFileAttributesExW
FileTimeToLocalFileTime
SetErrorMode
GetFileAttributesW
GetProfileIntW
GetTickCount
SearchPathW
GetWindowsDirectoryW
FindResourceExW
GetTempPathW
lstrcmpiW
GetCurrentProcess
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindFirstFileW
FindClose
CreateFileW
DeleteFileW
GetCurrentDirectoryW
GetThreadLocale
SystemTimeToFileTime
FileTimeToSystemTime
VirtualProtect
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GlobalGetAtomNameW
VerifyVersionInfoW
VerSetConditionMask
InitializeCriticalSection
GlobalFlags
lstrcpyW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpA
GetVersionExW
GetCurrentThread
ResumeThread
SetThreadPriority
SetEvent
GetCurrentProcessId
CopyFileW
FormatMessageW
LocalFree
GlobalSize
GlobalAlloc
WideCharToMultiByte
MultiByteToWideChar
GlobalFree
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryExW
FreeResource
FreeLibrary
GetSystemDirectoryW
GetCurrentThreadId
EncodePointer
LoadLibraryA
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
SetLastError
OutputDebugStringA
FindResourceW
SizeofResource
LockResource
LoadResource
GlobalUnlock
GlobalLock
MulDiv
LoadLibraryW
GetProcessHeap
ExitProcess
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
CloseHandle
HeapReAlloc
GetLastError
Sleep
CreateEventW
HeapSize
OpenEventW
WaitForSingleObject
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
GetModuleHandleExW

user32

TabbedTextOutW
GetWindowDC
BeginPaint
EndPaint
ClientToScreen
ScreenToClient
GetSysColor
FillRect
DrawStateW
UpdateWindow
InvalidateRect
GetClassNameW
LoadBitmapW
IsWindow
GetKeyNameTextW
MapVirtualKeyW
RegisterWindowMessageW
DispatchMessageW
PeekMessageW
GetMessagePos
GetMessageTime
PostMessageW
DefWindowProcW
CallWindowProcW
RegisterClassW
GetClassInfoW
GetClassInfoExW
CreateWindowExW
IsMenu
IsChild
DestroyWindow
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsWindowVisible
GetDlgItem
GetDlgCtrlID
SetFocus
GetFocus
GetKeyState
GetCapture
GetProcessWindowStation
DrawTextExW
DrawTextW
IntersectRect
InflateRect
CopyRect
ReleaseDC
GetDC
SetTimer
GetWindowRect
SetWindowPos
SendMessageW
GetSystemMetrics
UnregisterClassW
DrawIcon
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
CopyIcon
FrameRect
PostThreadMessageW
GetIconInfo
HideCaret
InvertRect
GetDoubleClickTime
IsCharLowerW
MapVirtualKeyExW
DrawMenuBar
LoadIconW
AnimateWindow
GetClientRect
SystemParametersInfoW
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
GetUpdateRect
SubtractRect
IsIconic
CreateMenu
EnableWindow
GetUserObjectInformationW
wsprintfA
GetMenu
SetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
TrackPopupMenu
SetActiveWindow
GetForegroundWindow
SetForegroundWindow
ValidateRect
RedrawWindow
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
SetPropW
GetPropW
RemovePropW
GetWindowTextW
GetWindowTextLengthW
AdjustWindowRectEx
MessageBoxW
MapWindowPoints
EqualRect
PtInRect
GetWindowLongW
SetWindowLongW
GetClassLongW
GetParent
GetTopWindow
GetLastActivePopup
GetWindow
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
SetScrollInfo
GetScrollInfo
WinHelpW
MonitorFromWindow
GetMonitorInfoW
ShowWindow
MoveWindow
SetDlgItemTextW
DestroyCursor
GetComboBoxInfo
RegisterClipboardFormatW
EmptyClipboard
SetClipboardData
CloseClipboard
CheckDlgButton
OpenClipboard
SetClassLongW
LockWindowUpdate
BringWindowToTop
SetParent
SetCursorPos
DestroyAcceleratorTable
CreateAcceleratorTableW
LoadAcceleratorsW
GetKeyboardState
GetKeyboardLayout
ToUnicodeEx
IsWindowEnabled
SetWindowTextW
IsDialogMessageW
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
GetActiveWindow
DrawIconEx
GetDesktopWindow
GetCursorPos
SendDlgItemMessageA
SetRectEmpty
OffsetRect
GetMenuStringW
SetRect
DrawFocusRect
DrawFrameControl
DrawEdge
GetMenuState
InsertMenuW
AppendMenuW
RemoveMenu
GetWindowThreadProcessId
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
GetMessageW
TranslateMessage
PostQuitMessage
ShowOwnedPopups
SetCursor
SetWindowContextHelpId
MapDialogRect
RealChildWindowFromPoint
GetSysColorBrush
LoadCursorW
SetLayeredWindowAttributes
EnumDisplayMonitors
LoadMenuW
IsClipboardFormatAvailable
GetNextDlgGroupItem
GetWindowRgn
DestroyMenu
GetMenuItemInfoW
CopyImage
GetAsyncKeyState
TrackMouseEvent
IsZoomed
CharUpperW
SetCapture
GrayStringW
CharUpperBuffW
ModifyMenuW
ReleaseCapture
KillTimer
GetSystemMenu
DeleteMenu
SetWindowRgn
MessageBeep
WindowFromPoint
NotifyWinEvent
CreatePopupMenu
GetMenuDefaultItem
SetMenuDefaultItem
IsRectEmpty
UpdateLayeredWindow
EnableScrollBar
UnionRect
MonitorFromPoint
DestroyIcon
LoadImageW
WaitMessage
CharNextW
CopyAcceleratorTableW
InvalidateRgn

gdi32

GetClipBox
ExcludeClipRect
Escape
CreateSolidBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
BitBlt
DPtoLP
ExtTextOutW
SetRectRgn
SetBkColor
PatBlt
GetMapMode
GetDeviceCaps
DeleteObject
CreateRectRgnIndirect
GetPixel
CreatePatternBrush
CreateFontIndirectW
CreateBitmap
CombineRgn
GetStockObject
DeleteDC
GetBoundsRect
PtInRegion
GetWindowOrgEx
GetViewportOrgEx
SetPixelV
GetTextFaceW
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextColor
SetTextAlign
GetObjectW
MoveToEx
TextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CopyMetaFileW
CreateDCW
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
GetTextMetricsW
GetTextExtentPoint32W
CreateRoundRectRgn
CreateDIBSection
GetBkColor
GetTextColor
GetRgnBox
CreateEllipticRgn
Ellipse
CreatePolygonRgn
Polygon
Polyline
EnumFontFamiliesExW
RealizePalette
SetPixel
StretchBlt
SetDIBColorTable
OffsetRgn
Rectangle
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
LPtoDP
RoundRect
GetObjectType
ExtFloodFill
SetPaletteEntries
FillRgn
CreateRectRgn
FrameRgn

msimg32

TransparentBlt
AlphaBlend

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegEnumKeyExW
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
SetFileSecurityW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
SetSecurityDescriptorDacl
GetTokenInformation
ConvertSidToStringSidW
RegOpenKeyExA
OpenProcessToken
RegQueryValueExA
RegCloseKey

shell32

DragFinish
DragQueryFileW
SHAppBarMessage
ShellExecuteW
SHGetFileInfoW
SHGetDesktopFolder
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHGetMalloc
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHCreateDirectoryExA

comctl32

InitCommonControlsEx

shlwapi

PathFileExistsA
StrStrIA
SHSetValueA
wnsprintfW
PathFileExistsW
PathAppendW
PathFindFileNameW
wvnsprintfA
PathFindFileNameA
PathFindExtensionW
PathRemoveFileSpecW
StrFormatKBSizeW
PathStripToRootW
wnsprintfA
PathIsUNCW

uxtheme

GetThemePartSize
IsAppThemed
DrawThemeParentBackground
DrawThemeText
IsThemeBackgroundPartiallyTransparent
CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
GetWindowTheme
OpenThemeData
GetThemeSysColor

ole32

CoRegisterMessageFilter
CoRevokeClassObject
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CoInitializeEx
CreateStreamOnHGlobal
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
CLSIDFromProgID
CLSIDFromString
CoInitialize
CoCreateInstance
CoCreateGuid
CoUninitialize
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc

oleaut32

VarBstrFromDate
OleCreateFontIndirect
LoadTypeLi
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysAllocString
SysFreeString
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen

oledlg

OleUIBusyW

gdiplus

GdipDrawImageRectI
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdipGetImageGraphicsContext
GdipGetImagePalette
GdipGetImagePaletteSize
GdipCreateBitmapFromStream
GdipCreateBitmapFromScan0
GdipBitmapLockBits
GdipBitmapUnlockBits
GdipDrawImageI
GdipGetImageWidth
GdipGetImageHeight
GdiplusShutdown
GdipGetImagePixelFormat

ws2_32

getsockname
getpeername
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
send
shutdown
getsockopt
ntohs
bind
WSAIoctl
closesocket
WSACloseEvent
WSACreateEvent
WSASetLastError
inet_addr
socket
connect
WSAWaitForMultipleEvents
recv
htons
setsockopt
WSAGetLastError
gethostname
gethostbyname
inet_ntoa
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
getnameinfo
getaddrinfo
recvfrom
sendto
ioctlsocket
listen
freeaddrinfo

oleacc

CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

iphlpapi

GetAdaptersAddresses

crypt32

CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertDuplicateCertificateContext

wldap32

ord41
ord208
ord216
ord117
ord46
ord219
ord145
ord26
ord27
ord127
ord167
ord142
ord79
ord133
ord147
ord301
ord14

netapi32

Netbios

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 783KB - Virtual size: 782KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 62KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 390KB - Virtual size: 389KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 217KB - Virtual size: 216KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
MiddleExe.exe
.exe windows:5 windows x86 arch:x86

27f188fab1158d5cb809a5a960b9281c

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:50:5a:83:78:11:67:7c:4d:63:16:b8:85:99:e0:47:3a:d4:0c:c2:d7:85:31:bf:24:47:fa:5a:20:c6:b4:f3
Signer

Actual PE Digest

0d:50:5a:83:78:11:67:7c:4d:63:16:b8:85:99:e0:47:3a:d4:0c:c2:d7:85:31:bf:24:47:fa:5a:20:c6:b4:f3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Release\Client\MiddleExe.pdb

Imports

kernel32

WriteConsoleW
CloseHandle
OutputDebugStringW
MultiByteToWideChar
OutputDebugStringA
HeapSize
GetConsoleMode
GetConsoleCP
GetProcessHeap
GetLastError
GetFileSizeEx
WriteFile
FlushFileBuffers
SetEndOfFile
SetFilePointerEx
FindClose
GetSystemInfo
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
CreateFileMappingW
CreateDirectoryW
CreateFileW
GetFileAttributesW
FindNextFileW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
Sleep
LockFileEx
UnlockFileEx
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetACP
HeapFree
HeapAlloc
GetFileType
LCMapStringW
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
DecodePointer

advapi32

RegCloseKey
RegOpenKeyExW
RegQueryValueExW

shell32

ShellExecuteExW

shlwapi

PathFileExistsW
PathAppendW

Sections

.text
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Mswtd.dll
.dll windows:5 windows x86 arch:x86

8d3ff3f551b2c93bb59286f2eeb1f511

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

75:d5:66:ec:a4:f7:6a:47:68:60:6a:1a:36:48:79:56:20:ba:aa:d2:f7:8b:73:c3:3b:fc:b0:a6:b0:02:7d:7a
Signer

Actual PE Digest

75:d5:66:ec:a4:f7:6a:47:68:60:6a:1a:36:48:79:56:20:ba:aa:d2:f7:8b:73:c3:3b:fc:b0:a6:b0:02:7d:7a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\Mswtd.pdb

Imports

kernel32

SystemTimeToTzSpecificLocalTime
SleepEx
QueueUserAPC
CloseHandle
SwitchToThread
TerminateThread
Sleep
WaitForSingleObject
DisableThreadLibraryCalls
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
QueryPerformanceFrequency
MoveFileExW
CreateDirectoryW
DecodePointer
SetStdHandle
GetTimeZoneInformation
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
WriteFile
CreateFileA
DeleteFileA
GetModuleFileNameA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetTickCount
OpenFileMappingW
GetLocalTime
CreateFileMappingW
MapViewOfFile
GetLogicalDrives
SetFileAttributesW
GetDriveTypeW
HeapFree
GetDriveTypeA
GetVolumeInformationA
HeapAlloc
SetFileAttributesA
GetComputerNameW
GetProcessHeap
GetPrivateProfileStringA
ReadFile
CreateMutexW
GetSystemDirectoryW
GetLastError
LocalFree
CreateProcessW
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LockFileEx
GetFileSize
DeleteCriticalSection
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTime
FormatMessageA
FlushFileBuffers
GetFileSizeEx
GetSystemDirectoryA
SetFilePointerEx
FindFirstFileW
SetLastError
FindNextFileW
DeviceIoControl
FindClose
GetModuleHandleA
OpenProcess
CreateEventW
FileTimeToSystemTime
LoadLibraryExW
RtlUnwind
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetFileType
GetModuleHandleExW
WriteConsoleW
ExitProcess
CreateThread
ExitThread
FreeLibraryAndExitThread
GetConsoleMode
ReadConsoleW
GetACP
GetStringTypeW
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetCurrentDirectoryW

advapi32

RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
SetServiceStatus
RegisterServiceCtrlHandlerExW
AllocateAndInitializeSid
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
SetFileSecurityW
RegCloseKey
SetSecurityDescriptorDacl
GetTokenInformation
RegQueryValueExW
RegQueryValueExA
OpenProcessToken
RegOpenKeyExA
ConvertSidToStringSidW

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExA
SHCreateDirectoryExW

shlwapi

PathAppendW
PathFileExistsW
PathFileExistsA
StrCmpIW
StrStrIA
SHSetValueA
wnsprintfA
PathFindFileNameA
wvnsprintfA
wnsprintfW

ws2_32

WSASetLastError
inet_addr
socket
connect
WSAWaitForMultipleEvents
recv
htons
WSACreateEvent
setsockopt
WSAGetLastError
gethostname
gethostbyname
inet_ntoa
select
accept
htonl
listen
getaddrinfo
recvfrom
sendto
WSACloseEvent
__WSAFDIsSet
WSAIoctl
bind
WSACleanup
send
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
getpeername
getsockname
getsockopt
ntohs
ioctlsocket
getnameinfo
shutdown
WSAStartup
closesocket
freeaddrinfo

iphlpapi

GetAdaptersAddresses

crypt32

CertOpenSystemStoreW
CertGetEnhancedKeyUsage
CertEnumCertificatesInStore
CertGetCertificateContextProperty
CertOpenStore
CertFindCertificateInStore
CertCloseStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertGetIntendedKeyUsage

wldap32

ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145

netapi32

Netbios

user32

MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
wsprintfA

Exports

Exports

ServiceMain

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 484KB - Virtual size: 484KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NFPCore.dll
.dll windows:5 windows x86 arch:x86

259a3e213ce1b0cc4cd9292bfebde227

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

83:4b:b8:27:14:0b:e6:bc:87:6c:62:92:c8:79:97:87:a9:4c:18:8a:dd:46:67:bc:41:ff:ea:b9:db:db:fd:31
Signer

Actual PE Digest

83:4b:b8:27:14:0b:e6:bc:87:6c:62:92:c8:79:97:87:a9:4c:18:8a:dd:46:67:bc:41:ff:ea:b9:db:db:fd:31

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\NFPCore.pdb

Imports

kernel32

SetEvent
CreateEventW
OpenEventW
GetVolumeInformationA
SystemTimeToTzSpecificLocalTime
GetFileAttributesW
OpenProcess
GetCurrentThreadId
DeviceIoControl
GetTickCount
GetProcessHeap
HeapAlloc
SetLastError
HeapFree
GetModuleHandleW
GetSystemDirectoryW
DeleteCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
GetVersionExW
GetDriveTypeW
SleepEx
GetCurrentProcessId
ReadDirectoryChangesW
QueueUserAPC
CloseHandle
TerminateThread
GetLastError
GlobalMemoryStatus
ConvertThreadToFiber
Sleep
CreateFileW
WaitForSingleObject
LeaveCriticalSection
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
MoveFileExW
CreateDirectoryW
DecodePointer
SetStdHandle
GetTimeZoneInformation
GetConsoleCP
EnterCriticalSection
GetLogicalDrives
SetConsoleCtrlHandler
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStringTypeW
GetACP
ReadConsoleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OpenMutexW
ReadFile
CreateMutexW
LocalFree
SetFileAttributesW
GetDriveTypeA
CreateFileA
SetFileAttributesA
GetModuleFileNameA
GetLocalTime
CreateFileMappingW
MapViewOfFile
DeleteFileA
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
WriteFile
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LockFileEx
GetFileSize
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTime
FormatMessageA
FlushFileBuffers
QueryDosDeviceW
FindFirstFileW
FindNextFileW
FindClose
GetModuleHandleA
FileTimeToSystemTime
LoadLibraryExW
GetFileSizeEx
GetSystemDirectoryA
SetFilePointerEx
GetVersion
RtlUnwind
RaiseException
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
WriteConsoleW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetConsoleMode
GetCurrentDirectoryW

advapi32

OpenProcessToken
RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
RegCloseKey
SetSecurityDescriptorDacl
GetTokenInformation
SetFileSecurityW
RegQueryValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize

oleaut32

SysAllocString
SysFreeString
SysStringLen

shlwapi

StrStrIW
SHGetValueW
wnsprintfW
PathFileExistsW
PathAppendW
wnsprintfA
SHSetValueA
PathAddBackslashW
PathFindFileNameA
wvnsprintfA

ws2_32

gethostname
WSACleanup
closesocket
gethostbyname
WSAStartup
inet_addr
gethostbyaddr
socket
inet_ntoa
recvfrom
sendto
setsockopt
WSAGetLastError
recv
connect
WSASetLastError
WSACreateEvent
WSACloseEvent
ioctlsocket
getnameinfo
shutdown
htons
WSAIoctl
bind
freeaddrinfo
send
WSAEnumNetworkEvents
WSAEventSelect
getpeername
getsockname
getsockopt
ntohs
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo

psapi

GetModuleFileNameExW
EnumProcesses

fltlib

FilterSendMessage
FilterConnectCommunicationPort

crypt32

CertFreeCertificateContext
CertCloseStore
CertDuplicateCertificateContext
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFindCertificateInStore

wldap32

ord41
ord117
ord216
ord145
ord219
ord46
ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord14
ord27
ord26
ord208

user32

wsprintfW
wsprintfA
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHCreateDirectoryExA

Exports

Exports

AddAccessDenyFile
AddInternalProcess
AddProtectedProcess
AddReadOnlyFile
AddXProcess
DestroyNFPService
FastPing
FsAddInternalProcess
InitNFPService
KnAddInternalProcess
NotifyVolumeChanged
Ping
PsTerminateProcessInKernel
RegisterFileChangedNotifyHandler
RegisterProcessNotifyCallback
RegisterVolumeChangedNotifyHandler
RegisterVolumeChangedNotifyHandler2
ReleaseBypassDrivers
RemoveAccessDenyFile
RemoveReadOnlyFile
RmvProtectedProcess
WindowsFirewallAddAppA
WindowsFirewallAddAppW

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 464KB - Virtual size: 463KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NSOutlookAddin32.dll
.dll regsvr32 windows:5 windows x86 arch:x86

5abfd4b6a6a957487523fd262b77be38

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

89:5c:5c:a2:90:bb:04:2f:ab:eb:52:39:78:c6:bf:44:4f:5a:55:4c:45:73:d6:72:96:9f:8f:42:8c:ec:9e:d2
Signer

Actual PE Digest

89:5c:5c:a2:90:bb:04:2f:ab:eb:52:39:78:c6:bf:44:4f:5a:55:4c:45:73:d6:72:96:9f:8f:42:8c:ec:9e:d2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\NSOutlookAddin32.pdb

Imports

kernel32

SystemTimeToTzSpecificLocalTime
GetCurrentProcessId
SetThreadLocale
GetThreadLocale
EncodePointer
DecodePointer
MultiByteToWideChar
FindResourceW
GetModuleHandleW
GetModuleFileNameW
lstrcmpiW
CloseHandle
SizeofResource
LoadResource
Sleep
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CreateDirectoryW
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
LoadLibraryExW
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
GetLastError
RaiseException
GetProcAddress
FreeLibrary
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
MoveFileExW
SleepEx
SetStdHandle
GetConsoleCP
SetConsoleCtrlHandler
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
InterlockedDecrement
InterlockedIncrement
FindFirstFileExA
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
GetStringTypeW
GetACP
ReadConsoleW
GetConsoleMode
FreeLibraryAndExitThread
ExitThread
CreateThread
WriteConsoleW
GetFileType
GetStdHandle
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
RtlUnwind
SetFilePointerEx
GetSystemDirectoryA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
WideCharToMultiByte
LocalFree
GetModuleFileNameA
InitializeCriticalSection
GetTickCount
GetLocalTime
GetLogicalDrives
HeapFree
GetDriveTypeA
GetVolumeInformationA
CreateFileA
HeapAlloc
SetFileAttributesA
GetComputerNameW
GetProcessHeap
GetPrivateProfileStringA
SetFileAttributesW
GetDriveTypeW
ReadFile
CreateMutexW
WaitForSingleObject
WriteFile
DeleteFileA
CreateFileMappingW
MapViewOfFile
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSize
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
FindFirstFileW
SetLastError
FindNextFileW
DeviceIoControl
FindClose
GetModuleHandleA
OpenProcess
CreateEventW
FileTimeToSystemTime
GetFileSizeEx
GetCurrentDirectoryW

user32

SendMessageW
FindWindowW
CharNextW
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
wsprintfA

advapi32

InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
ConvertSidToStringSidW
RegOpenKeyExA
OpenProcessToken
SetSecurityDescriptorDacl
GetTokenInformation
CryptGenRandom
CryptDecrypt
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
SetFileSecurityW
ConvertSidToStringSidA
RegQueryValueExA
RegQueryValueExW

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHCreateDirectoryExA

ole32

CoTaskMemFree
CoTaskMemRealloc
StringFromGUID2
CoTaskMemAlloc
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoInitializeEx
CoUninitialize
CoCreateInstance
CoCreateGuid

oleaut32

SysAllocStringLen
UnRegisterTypeLi
RegisterTypeLi
SysAllocString
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
VariantClear
VariantInit
SysStringLen
SysFreeString

shlwapi

wvnsprintfA
StrToIntExA
SHDeleteValueA
PathAppendA
PathFileExistsA
SHSetValueW
SHSetValueA
wvnsprintfW
PathAppendW
wnsprintfA
wnsprintfW
PathFileExistsW
PathFindFileNameW
SHGetValueW
PathFindFileNameA

iphlpapi

GetAdaptersAddresses

netapi32

Netbios

ws2_32

gethostname
getsockopt
select
gethostbyname
WSAGetLastError
setsockopt
sendto
recv
connect
ioctlsocket
getnameinfo
shutdown
htons
htonl
socket
inet_addr
WSASetLastError
WSACreateEvent
WSACloseEvent
listen
closesocket
WSAIoctl
bind
recvfrom
send
WSAEnumNetworkEvents
WSAEventSelect
freeaddrinfo
getpeername
getsockname
__WSAFDIsSet
WSACleanup
WSAStartup
ntohs
accept
inet_ntoa
getaddrinfo

crypt32

CertFreeCertificateContext
CertDuplicateCertificateContext
CertCloseStore
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFindCertificateInStore

wldap32

ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord216
ord14
ord145
ord46
ord219
ord208

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 471KB - Virtual size: 471KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NSec.exe
.exe windows:5 windows x86 arch:x86

90f823c8c334b9c2539fc10323a88ae6

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d5:65:bd:b8:22:c4:42:4d:ca:25:87:66:0d:b8:3a:c2:ea:bd:45:a9:60:72:d3:4e:38:e8:a1:7e:a9:4e:17:a6
Signer

Actual PE Digest

d5:65:bd:b8:22:c4:42:4d:ca:25:87:66:0d:b8:3a:c2:ea:bd:45:a9:60:72:d3:4e:38:e8:a1:7e:a9:4e:17:a6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Release\Client\NSec.pdb

Imports

kernel32

GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
WriteConsoleW
GetACP
FreeEnvironmentStringsW
GetFileType
SetStdHandle
QueryPerformanceFrequency
HeapQueryInformation
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetCommandLineW
GetCommandLineA
VirtualQuery
VirtualAlloc
InterlockedPushEntrySList
RtlUnwind
SleepEx
OpenProcess
RemoveDirectoryW
DeviceIoControl
FindNextFileW
SetFilePointerEx
GetSystemDirectoryA
FormatMessageA
GetSystemTime
LockFileEx
CreateFileMappingA
HeapCompact
GetVersionExA
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnmapViewOfFile
UnlockFileEx
GetFullPathNameA
InterlockedCompareExchange
HeapCreate
TryEnterCriticalSection
AreFileApisANSI
ReleaseMutex
GetModuleFileNameA
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetPrivateProfileStringA
CreateDirectoryA
GetComputerNameW
SetFileAttributesA
WritePrivateProfileStringA
GetVolumeInformationA
GetDriveTypeA
DeleteFileA
GetDriveTypeW
GetDiskFreeSpaceExW
OutputDebugStringW
SetEnvironmentVariableA
MoveFileExW
CompareFileTime
GetEnvironmentVariableA
WaitForMultipleObjects
PeekNamedPipe
SetConsoleMode
ReadConsoleA
GetEnvironmentVariableW
InterlockedExchangeAdd
GetVersion
DeleteFiber
SwitchToFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GetConsoleCP
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetSystemInfo
GlobalMemoryStatus
CreateDirectoryW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
QueryPerformanceCounter
WaitForSingleObjectEx
ResetEvent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStringTypeW
LCMapStringW
GetCPInfo
GetSystemTimeAsFileTime
SwitchToThread
GetEnvironmentStringsW
GetUserDefaultLCID
GetTempFileNameW
GetDiskFreeSpaceW
SystemTimeToTzSpecificLocalTime
SetFileAttributesW
GetFileTime
GetFileSizeEx
FileTimeToLocalFileTime
SetErrorMode
GetFileAttributesW
GetProfileIntW
SearchPathW
GetWindowsDirectoryW
FindResourceExW
GetTempPathW
lstrcmpiW
GetCurrentProcess
DuplicateHandle
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindFirstFileW
FindClose
CreateFileW
DeleteFileW
GetCurrentDirectoryW
GetThreadLocale
SystemTimeToFileTime
FileTimeToSystemTime
VirtualProtect
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GlobalGetAtomNameW
VerifyVersionInfoW
lstrcpyW
VerSetConditionMask
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
lstrcmpA
GetVersionExW
GetCurrentThread
SetThreadPriority
SetEvent
FormatMessageW
LocalFree
GlobalSize
GlobalAlloc
MulDiv
MultiByteToWideChar
GlobalFree
GlobalUnlock
GlobalLock
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
LoadLibraryA
LoadLibraryExW
GetModuleHandleW
GetModuleHandleA
FreeResource
FreeLibrary
GetSystemDirectoryW
SetLastError
EncodePointer
OutputDebugStringA
FindResourceW
SizeofResource
LockResource
LoadResource
CreateProcessW
GetFileAttributesExW
CreateEventW
ResumeThread
OpenEventW
WideCharToMultiByte
OpenMutexW
GetLocalTime
GetProcAddress
LoadLibraryW
CopyFileW
GetCurrentProcessId
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
GetModuleFileNameW
GetTickCount
GetCurrentThreadId
WaitForSingleObject
InterlockedExchange
CreateFileA
WriteFile
ReadFile
GetProcessHeap
ExitProcess
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
RaiseException
CloseHandle
HeapReAlloc
GetLastError
Sleep
HeapSize
CreateMutexW
InitializeCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
HeapFree
GetStdHandle
GetLogicalDrives

user32

IsIconic
GetClientRect
LoadIconW
DrawIcon
UnregisterClassW
GetSystemMetrics
SendMessageW
MessageBoxW
ReleaseDC
InvalidateRect
GetUserObjectInformationW
EnableWindow
GetDC
GetWindowRect
GetDlgItemTextA
PostQuitMessage
GetLastInputInfo
PostMessageW
GetParent
KillTimer
ClientToScreen
SetDlgItemTextA
SetDlgItemTextW
GetDlgItemTextW
EnableMenuItem
SetWindowPos
GetSystemMenu
DrawStateW
UpdateWindow
FillRect
GetClassNameW
LoadBitmapW
RegisterWindowMessageW
DispatchMessageW
PeekMessageW
GetMessagePos
GetMessageTime
DefWindowProcW
CallWindowProcW
RegisterClassW
GetClassInfoW
GetClassInfoExW
CreateWindowExW
IsWindow
IsMenu
IsChild
DestroyWindow
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsWindowVisible
GetDlgItem
GetDlgCtrlID
SetFocus
GetFocus
GetProcessWindowStation
DrawIconEx
GetKeyboardLayout
GetKeyboardState
LoadAcceleratorsW
MonitorFromPoint
CreateAcceleratorTableW
DestroyAcceleratorTable
SetCursorPos
SetParent
BringWindowToTop
LockWindowUpdate
SetClassLongW
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
RegisterClipboardFormatW
CharUpperBuffW
ToUnicodeEx
ModifyMenuW
SetTimer
TranslateAcceleratorW
InsertMenuItemW
UnpackDDElParam
ReuseDDElParam
CopyIcon
FrameRect
PostThreadMessageW
GetIconInfo
HideCaret
InvertRect
GetDoubleClickTime
IsCharLowerW
MapVirtualKeyExW
DrawMenuBar
DefFrameProcW
DefMDIChildProcW
TranslateMDISysAccel
IsClipboardFormatAvailable
GetUpdateRect
SubtractRect
wsprintfA
wsprintfW
GetKeyState
GetCapture
GetMenu
SetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
TrackPopupMenu
SetActiveWindow
GetForegroundWindow
SetForegroundWindow
BeginPaint
EndPaint
ValidateRect
RedrawWindow
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
SetPropW
GetPropW
RemovePropW
GetWindowTextW
GetWindowTextLengthW
AdjustWindowRectEx
ScreenToClient
MapWindowPoints
GetSysColor
CopyRect
EqualRect
PtInRect
GetWindowLongW
SetWindowLongW
GetClassLongW
GetTopWindow
GetLastActivePopup
GetWindow
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
SetScrollInfo
GetScrollInfo
WinHelpW
MonitorFromWindow
GetMonitorInfoW
ShowWindow
MoveWindow
CreateMenu
DestroyCursor
DrawFocusRect
DrawFrameControl
DrawEdge
GetNextDlgGroupItem
CheckDlgButton
SetRect
InvalidateRgn
CopyAcceleratorTableW
CharNextW
WaitMessage
LoadImageW
DestroyIcon
DeleteMenu
UnionRect
EnableScrollBar
UpdateLayeredWindow
IsRectEmpty
IsWindowEnabled
SetWindowTextW
IsDialogMessageW
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
GetActiveWindow
SetMenuDefaultItem
GetDesktopWindow
GetCursorPos
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
GetWindowDC
GetMenuDefaultItem
CreatePopupMenu
NotifyWinEvent
IntersectRect
SendDlgItemMessageA
SetRectEmpty
OffsetRect
GetMenuStringW
GetMenuState
InsertMenuW
AppendMenuW
RemoveMenu
GetKeyNameTextW
MapVirtualKeyW
GetWindowThreadProcessId
CheckMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
GetMessageW
TranslateMessage
ShowOwnedPopups
SetCursor
SetWindowContextHelpId
MapDialogRect
LoadMenuW
DestroyMenu
WindowFromPoint
MessageBeep
GetComboBoxInfo
GetMenuItemInfoW
InflateRect
SystemParametersInfoW
SetLayeredWindowAttributes
GetSysColorBrush
LoadCursorW
EnumDisplayMonitors
CopyImage
RealChildWindowFromPoint
GetWindowRgn
GetAsyncKeyState
TrackMouseEvent
IsZoomed
CharUpperW
SetCapture
ReleaseCapture
SetWindowRgn

gdi32

GetDIBColorTable
SetDIBColorTable
CreateCompatibleDC
StretchBlt
GetObjectW
DeleteObject
CreateSolidBrush
DeleteDC
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
LPtoDP
RoundRect
ExtFloodFill
SetPaletteEntries
FillRgn
SelectObject
GetBoundsRect
PtInRegion
GetWindowOrgEx
GetViewportOrgEx
SetPixelV
GetTextFaceW
SetStretchBltMode
GetStockObject
SetBkColor
SetTextColor
BitBlt
CreateBitmap
CreateHatchBrush
CreatePen
CreatePatternBrush
CreateRectRgn
Escape
ExcludeClipRect
GetClipBox
GetDeviceCaps
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
MoveToEx
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CopyMetaFileW
CreateDCW
CreateRectRgnIndirect
PatBlt
CreateFontIndirectW
GetTextExtentPoint32W
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
GetTextMetricsW
CreateRoundRectRgn
CombineRgn
GetMapMode
SetRectRgn
DPtoLP
GetBkColor
GetTextColor
GetRgnBox
CreateEllipticRgn
Ellipse
CreatePolygonRgn
Polygon
Polyline
EnumFontFamiliesExW
CreateDIBSection
RealizePalette
SetPixel
OffsetRgn
FrameRgn
CreatePalette
Rectangle

msimg32

AlphaBlend
TransparentBlt

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

RegCloseKey
RegNotifyChangeKeyValue
RegQueryValueExW
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegEnumKeyW
RegQueryValueW
RegEnumValueW
RegEnumKeyExW
SetFileSecurityW
CryptGenRandom
CryptDecrypt
RegOpenKeyExA
RegCreateKeyExA
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
ConvertSidToStringSidW
CheckTokenMembership
FreeSid
OpenProcessToken
RegSetValueExA
RegOpenKeyExW
RegQueryValueExA
EqualSid
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CryptEnumProvidersW
CryptReleaseContext
CryptDestroyKey
CryptGetProvParam
CryptAcquireContextW
CryptGetUserKey
CryptExportKey
CryptDestroyHash
CryptSignHashW
CryptSetHashParam
CryptCreateHash

shell32

ShellExecuteW
SHGetFileInfoW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
SHAppBarMessage
DragQueryFileW
DragFinish
SHBrowseForFolderW
SHGetSpecialFolderPathW
SHCreateDirectoryExA
SHCreateDirectoryExW
ShellExecuteExW

comctl32

InitCommonControlsEx

shlwapi

PathFindFileNameW
PathAppendW
SHSetValueA
SHEnumKeyExW
SHGetValueW
SHSetValueW
SHDeleteValueW
PathMatchSpecW
PathFindExtensionW
wnsprintfW
PathRemoveFileSpecW
PathIsUNCW
PathStripToRootW
StrFormatKBSizeW
StrToIntExA
PathAddBackslashW
StrCmpIW
wvnsprintfA
PathFindFileNameA
StrCmpNIA
PathFileExistsA
PathAppendA
StrStrIA
PathFileExistsW
wnsprintfA
SHGetValueA

uxtheme

GetThemePartSize
IsThemeBackgroundPartiallyTransparent
GetWindowTheme
GetThemeSysColor
GetCurrentThemeName
GetThemeColor
DrawThemeBackground
CloseThemeData
IsAppThemed
OpenThemeData
DrawThemeText
DrawThemeParentBackground

ole32

CoRegisterMessageFilter
CoRevokeClassObject
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CreateStreamOnHGlobal
DoDragDrop
OleIsCurrentClipboard
OleFlushClipboard
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
CoInitializeEx
CLSIDFromProgID
CLSIDFromString
CoInitialize
CoCreateInstance
CoUninitialize
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoCreateGuid

oleaut32

LoadTypeLi
VarBstrFromDate
OleCreateFontIndirect
SysFreeString
VariantCopy
VariantClear
SysAllocStringLen
VariantInit
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysAllocString
VariantChangeType

oledlg

OleUIBusyW

gdiplus

GdipGetImagePixelFormat
GdipFree
GdipBitmapLockBits
GdipGetImageGraphicsContext
GdipAlloc
GdipGetImagePalette
GdipGetImageWidth
GdipCreateBitmapFromFile
GdipCreateBitmapFromScan0
GdipDrawImageI
GdiplusShutdown
GdipCloneImage
GdipDeleteGraphics
GdipGetImagePaletteSize
GdipGetImageHeight
GdiplusStartup
GdipCreateBitmapFromHBITMAP
GdipCreateFromHDC
GdipSetInterpolationMode
GdipDisposeImage
GdipDrawImageRectI
GdipCreateBitmapFromStream
GdipBitmapUnlockBits

ws2_32

getsockopt
getsockname
getpeername
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
send
WSACleanup
__WSAFDIsSet
sendto
bind
WSAIoctl
closesocket
WSACloseEvent
WSACreateEvent
WSASetLastError
inet_addr
socket
connect
WSAWaitForMultipleEvents
recv
select
setsockopt
WSAGetLastError
gethostname
gethostbyname
inet_ntoa
WSAStartup
accept
htons
recvfrom
freeaddrinfo
getaddrinfo
listen
ioctlsocket
getnameinfo
shutdown
ntohs
htonl

oleacc

LresultFromObject
AccessibleObjectFromWindow
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

iphlpapi

GetAdaptersAddresses

crypt32

CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertDuplicateCertificateContext
CertGetCertificateContextProperty

wldap32

ord41
ord208
ord216
ord14
ord46
ord219
ord145
ord142
ord79
ord133
ord147
ord301
ord127
ord117
ord167
ord27
ord26

netapi32

Netbios

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

Sections

.text
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 832KB - Virtual size: 831KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 63KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 389KB - Virtual size: 388KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 228KB - Virtual size: 227KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NSecDs.exe
.exe windows:5 windows x86 arch:x86

dadce52c974ac2c29bd176b4b35666e6

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4a:43:82:7f:3a:e5:53:9e:e0:ae:78:7a:6d:ec:db:cd:08:a8:9a:4c:02:75:37:40:42:40:a2:04:31:a7:b0:19
Signer

Actual PE Digest

4a:43:82:7f:3a:e5:53:9e:e0:ae:78:7a:6d:ec:db:cd:08:a8:9a:4c:02:75:37:40:42:40:a2:04:31:a7:b0:19

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Release\Client\NSecDs.pdb

Imports

kernel32

SystemTimeToTzSpecificLocalTime
SwitchToThread
ResumeThread
SuspendThread
OpenThread
InterlockedIncrement
MultiByteToWideChar
FindResourceW
GetCommandLineW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
CreateEventW
lstrcmpiW
CloseHandle
SizeofResource
LoadResource
GetCurrentDirectoryW
WaitForSingleObject
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetLastError
GetCurrentThreadId
CreateThread
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
Sleep
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetProcAddress
FreeLibrary
InterlockedCompareExchange
InterlockedExchange
GetEnvironmentVariableA
CompareFileTime
QueryPerformanceFrequency
MoveFileExW
CreateDirectoryW
ReadConsoleW
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
GetStringTypeW
SetStdHandle
SetConsoleCtrlHandler
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindFirstFileExW
InterlockedDecrement
DecodePointer
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
WriteConsoleW
GetFileType
FreeLibraryAndExitThread
ExitThread
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
InterlockedPushEntrySList
RtlUnwind
CopyFileW
SleepEx
FileTimeToLocalFileTime
FileTimeToSystemTime
IsDebuggerPresent
OutputDebugStringW
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
CreateMutexW
ReleaseMutex
DeleteFileA
LocalFree
AreFileApisANSI
ReadFile
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
FlushViewOfFile
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileW
GetSystemInfo
LoadLibraryW
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSize
SystemTimeToFileTime
WideCharToMultiByte
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
GetTickCount
FlushFileBuffers
OpenMutexW
GetLogicalDrives
SetFileAttributesW
GetDriveTypeW
GetSystemDirectoryW
GetDriveTypeA
GetVolumeInformationA
SetFileAttributesA
GetComputerNameW
GetPrivateProfileStringA
GetModuleFileNameA
OpenFileMappingW
GetLocalTime
OpenEventW
GetFileSizeEx
GetSystemDirectoryA
SetFilePointerEx
lstrlenW
lstrcpynW
FindFirstFileW
SetLastError
FindNextFileW
DeviceIoControl
FindClose
GetModuleHandleA
OpenProcess

user32

TranslateMessage
PostThreadMessageW
CharUpperW
CharNextW
MessageBoxW
GetMessageW
LoadStringW
DispatchMessageW
wsprintfA
GetUserObjectInformationW
GetProcessWindowStation

advapi32

RegQueryValueExA
SetFileSecurityW
ConvertStringSecurityDescriptorToSecurityDescriptorW
InitializeSecurityDescriptor
CryptEnumProvidersW
CryptReleaseContext
SetEntriesInAclW
AllocateAndInitializeSid
QueryServiceStatus
SetSecurityDescriptorDacl
GetTokenInformation
ConvertSidToStringSidW
RegOpenKeyExA
OpenProcessToken
CryptGenRandom
CryptDecrypt
CryptCreateHash
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW
CryptDestroyKey
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam

ole32

CoAddRefServerProcess
CoReleaseServerProcess
CoResumeClassObjects
CoRevokeClassObject
CoRegisterClassObject
CoInitializeEx
CoCreateInstance
StringFromGUID2
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoImpersonateClient
CoRevertToSelf
CoUninitialize
CoInitialize
CoInitializeSecurity
CoSetProxyBlanket

oleaut32

SysAllocString
LoadRegTypeLi
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysFreeString

iphlpapi

GetAdaptersAddresses

netapi32

Netbios

ws2_32

inet_ntoa
gethostbyname
WSAGetLastError
setsockopt
htons
recv
WSAWaitForMultipleEvents
connect
socket
inet_addr
WSASetLastError
WSACreateEvent
ioctlsocket
getnameinfo
shutdown
gethostname
WSACloseEvent
closesocket
WSAIoctl
bind
sendto
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
getpeername
getsockname
getsockopt
ntohs
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
send

crypt32

CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertDuplicateCertificateContext
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty

wldap32

ord147
ord133
ord167
ord219
ord46
ord14
ord216
ord208
ord41
ord117
ord26
ord27
ord127
ord142
ord79
ord301
ord145

shell32

SHCreateDirectoryExA
SHCreateDirectoryExW
SHGetSpecialFolderPathW

shlwapi

PathFindExtensionW
PathAppendA
SHSetValueA
PathFileExistsA
PathFileExistsW
wnsprintfA
PathIsNetworkPathW
PathFindFileNameW
wnsprintfW
PathAppendW
StrToInt64ExA
SHSetValueW
SHDeleteValueA
StrStrIA
PathFindFileNameA
wvnsprintfA
wvnsprintfW

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 633KB - Virtual size: 633KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NSecRTS.exe
.exe windows:5 windows x86 arch:x86

444f0bc1fbece231a4ca9114359a9ac5

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d6:73:7a:5c:7b:39:76:3d:93:0a:df:11:95:cf:70:b1:3e:ae:d4:0f:89:cd:99:a5:70:37:b4:bf:ae:d9:f9:52
Signer

Actual PE Digest

d6:73:7a:5c:7b:39:76:3d:93:0a:df:11:95:cf:70:b1:3e:ae:d4:0f:89:cd:99:a5:70:37:b4:bf:ae:d9:f9:52

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Release\Client\NSecRTS.pdb

Imports

kernel32

WaitForMultipleObjects
GetComputerNameW
SetProcessWorkingSetSize
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
VirtualFree
VirtualAlloc
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
ChangeTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
GetModuleFileNameA
MoveFileW
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
GetExitCodeProcess
TerminateJobObject
CreateProcessW
QueueUserAPC
ReadFileEx
OpenProcess
DuplicateHandle
CreateJobObjectW
CreateNamedPipeW
AssignProcessToJobObject
GetCurrentProcess
SetInformationJobObject
GetStartupInfoW
GetDiskFreeSpaceExA
GlobalUnlock
InterlockedIncrement
GlobalLock
ResetEvent
InterlockedDecrement
InterlockedExchange
QueueUserWorkItem
GetFileTime
GetDriveTypeW
SetFilePointerEx
FileTimeToLocalFileTime
GetDiskFreeSpaceExW
FileTimeToSystemTime
GetSystemDirectoryW
FindClose
FindNextFileW
GetFileSizeEx
FindFirstFileW
GetLogicalDrives
GetVolumeInformationW
GetComputerNameExW
SetComputerNameExW
CreateEventW
OpenMutexW
GetModuleHandleW
ExitProcess
SetEvent
ProcessIdToSessionId
OpenEventW
SetErrorMode
GetModuleFileNameW
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
WideCharToMultiByte
FreeLibrary
SystemTimeToFileTime
RemoveDirectoryW
CreateEventA
SetLocalTime
GlobalSize
GenerateConsoleCtrlEvent
FreeConsole
AttachConsole
ResumeThread
SetConsoleCtrlHandler
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
GetFileSize
LockFileEx
LocalFree
CreateFileMappingA
GetProcAddress
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
CloseHandle
HeapReAlloc
DeleteFileW
DeleteFileA
GetVersionExA
SetThreadPriority
LoadLibraryA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetLastError
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetVersionExW
GlobalFree
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LocalAlloc
SleepEx
CopyFileW
TerminateThread
TerminateProcess
CopyFileExW
MoveFileExW
SetFileAttributesW
GetHandleInformation
GetLocalTime
CopyFileA
ReleaseMutex
GetFileAttributesExA
Process32FirstW
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
GetEnvironmentVariableA
CompareFileTime
QueryPerformanceFrequency
WriteConsoleW
GetCurrentDirectoryW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetCurrentThread
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetACP
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwind
IsWow64Process
CreateTimerQueue
DeleteTimerQueueTimer
CreateTimerQueueTimer
InterlockedExchangeAdd
ReleaseSemaphore
OpenFileMappingW
EnumResourceNamesW
EnumResourceTypesW
MoveFileExA
GetPrivateProfileStringA
CreateDirectoryA
WritePrivateProfileStringA
GetUserDefaultUILanguage
CreatePipe
GetStdHandle
SetHandleInformation
CreateThread
LocalFileTimeToFileTime
CreateDirectoryW
GetNativeSystemInfo
lstrcmpiW
GlobalMemoryStatusEx
GetDateFormatW
GetWindowsDirectoryW
GetSystemWow64DirectoryW
CancelWaitableTimer
CreateWaitableTimerW
SetWaitableTimer
GetProcessId
VirtualProtect
WriteProcessMemory
lstrlenW
SetFileAttributesA
GetSystemDirectoryA
LoadLibraryExW
ReadProcessMemory
WTSGetActiveConsoleSessionId
FindResourceW
LoadResource
LockResource
GetLogicalDriveStringsW
Process32NextW
WaitForSingleObjectEx
CreateToolhelp32Snapshot
FreeResource
GetModuleHandleA
GetVolumeInformationA
GetDriveTypeA
DeviceIoControl
lstrcpynW
CancelIo
QueryDosDeviceW
SizeofResource
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
SetLastError
GetStringTypeW
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetCurrentThreadId
InterlockedCompareExchange
WriteFile
GetFullPathNameW
EnterCriticalSection
HeapFree
HeapCreate
TryEnterCriticalSection
AreFileApisANSI
ReadFile
GlobalAlloc

user32

GetUserObjectInformationW
AppendMenuW
PostQuitMessage
EnableMenuItem
GetProcessWindowStation
RegisterWindowMessageW
SetForegroundWindow
GetCursorPos
GetDesktopWindow
IsIconic
EnumDisplayMonitors
GetMonitorInfoW
SetWindowPos
IsClipboardFormatAvailable
SetClipboardData
LoadIconW
OpenClipboard
GetDC
GetClipboardSequenceNumber
GetClipboardData
GetPriorityClipboardFormat
GetClipboardOwner
LockWorkStation
FindWindowExA
EndPaint
BeginPaint
UpdateWindow
SystemParametersInfoW
SetWindowLongW
SetLayeredWindowAttributes
MoveWindow
RegisterClassW
DispatchMessageW
ShowWindow
LoadImageW
DestroyIcon
GetWindowRect
BlockInput
DestroyMenu
SetMenuItemInfoW
GetSubMenu
GetMenuItemCount
MessageBoxW
GetMenuItemInfoW
FindWindowA
FindWindowW
PostMessageW
UpdateLayeredWindow
TranslateMessage
RegisterHotKey
ChangeClipboardChain
CloseDesktop
GetThreadDesktop
TrackPopupMenu
RegisterClassExW
CreatePopupMenu
GetGuiResources
wsprintfW
RealGetWindowClassW
GetWindowInfo
IsZoomed
LoadCursorW
EnumDisplaySettingsW
ReleaseDC
GetLastInputInfo
GetForegroundWindow
wsprintfA
UnregisterClassW
SetThreadDesktop
CreateDesktopW
SendMessageTimeoutW
GetWindowLongW
GetWindowThreadProcessId
EnumWindows
GetWindowTextW
GetMessageW
DefWindowProcW
ModifyMenuW
UnregisterHotKey
DispatchMessageA
InsertMenuItemW
DestroyWindow
SetClipboardViewer
CreateWindowExW
SendMessageW
GetSystemMetrics
DrawIconEx
IsWindowVisible
CloseClipboard
EnumChildWindows
OpenInputDesktop
CharNextW
CharUpperW
EnableWindow
AttachThreadInput
IsWindow
EnumDisplayDevicesW

gdi32

DeleteObject
GetObjectA
DeleteDC
CreateFontW
CreateCompatibleDC
CreateDIBSection
SelectObject
GetDeviceCaps
GetObjectW
GetDIBits
BitBlt
CreateDCW
CreatePen
CreateCompatibleBitmap
Ellipse
CreateSolidBrush
SetBkMode
GetTextMetricsW
TextOutW
SetTextColor
GetStockObject

advapi32

CreateProcessAsUserW
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CloseEventLog
ReadEventLogW
OpenEventLogA
RegisterServiceCtrlHandlerExW
SetSecurityDescriptorDacl
GetSecurityDescriptorDacl
BuildExplicitAccessWithNameW
SetServiceStatus
SetEntriesInAclW
SetServiceObjectSecurity
InitializeSecurityDescriptor
QueryServiceObjectSecurity
RegQueryValueExW
CreateServiceW
ChangeServiceConfig2W
DeleteService
StartServiceCtrlDispatcherW
RegCreateKeyExW
GetUserNameW
RegEnumKeyExW
UnlockServiceDatabase
LockServiceDatabase
QueryServiceStatusEx
RevertToSelf
OpenProcessToken
SetThreadToken
DuplicateTokenEx
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
ControlService
StartServiceW
EnumServicesStatusExW
QueryServiceConfigW
ChangeServiceConfigW
QueryServiceConfig2W
OpenServiceW
InitiateSystemShutdownExW
RegCloseKey
RegOpenKeyExA
RegOpenKeyExW
RegDeleteValueA
RegEnumValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
LookupAccountNameW
LookupAccountSidW
ConvertSidToStringSidW
ImpersonateLoggedOnUser
CheckTokenMembership
FreeSid
RegSetValueExA
RegSetValueExW
RegCreateKeyExA
AllocateAndInitializeSid
SetTokenInformation
RegQueryValueExA
EqualSid
ConvertSidToStringSidA
SetFileSecurityW
AdjustTokenPrivileges
LookupPrivilegeValueW
LsaClose
LsaOpenPolicy
LsaFreeMemory
RegDeleteValueW
RegQueryInfoKeyW
RegSetKeySecurity
GetOldestEventLogRecord
NotifyChangeEventLog
OpenEventLogW
ReadEventLogA
GetNumberOfEventLogRecords
LsaSetInformationPolicy
LsaQueryInformationPolicy
CryptGenRandom

shell32

SHGetSpecialFolderPathW
ord2
SHCreateDirectoryExA
SHGetFolderPathW
SHCreateDirectoryExW
Shell_NotifyIconW
ShellExecuteExW
SHFileOperationW

ole32

CLSIDFromString
StringFromGUID2
CoInitializeEx
CoCreateGuid
CoInitializeSecurity
StringFromCLSID
CreateStreamOnHGlobal
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemFree
StgCreateDocfile
CoSetProxyBlanket
OleUninitialize
GetHGlobalFromStream
OleInitialize
WriteClassStg

oleaut32

SysStringLen
VariantClear
SysAllocString
SysFreeString
VariantInit

shlwapi

SHEnumKeyExW
StrCmpNIA
PathFileExistsW
PathFindFileNameA
StrToInt64ExA
PathAddBackslashW
SHGetValueA
SHDeleteValueW
SHSetValueW
PathFileExistsA
SHDeleteKeyW
PathMatchSpecW
StrStrIW
SHSetValueA
PathRemoveExtensionW
StrStrIA
SHGetValueW
PathAddExtensionW
PathFindExtensionW
PathFindExtensionA
PathIsDirectoryA
StrToIntExW
StrToIntExA
StrToIntA
SHDeleteValueA
PathAppendA
StrCmpNIW
PathIsDirectoryW
StrToInt64ExW
PathUnquoteSpacesW
StrCmpNW
StrCpyW
SHEnumKeyExA
SHEnumValueA
PathIsPrefixW
StrStrW
PathFindFileNameW
PathAppendW
wnsprintfW
wvnsprintfW
StrCmpIW
wvnsprintfA
PathIsNetworkPathW
StrCmpW
wnsprintfA

gdiplus

GdipGetImageEncoders
GdipCreateBitmapFromHBITMAP
GdipAlloc
GdipFillEllipseI
GdipGetImageHeight
GdipSaveImageToFile
GdipCreateBitmapFromScan0
GdipGetImageGraphicsContext
GdipGraphicsClear
GdipCreateMetafileFromFile
GdipDrawImageRectI
GdiplusShutdown
GdipSaveImageToStream
GdipCloneBitmapAreaI
GdiplusStartup
GdipGetImageWidth
GdipFree
GdipDisposeImage
GdipCloneImage
GdipDeleteGraphics
GdipGetPenFillType
GdipSetStringFormatAlign
GdipCreatePen1
GdipDeletePen
GdipTranslateWorldTransform
GdipDeleteFont
GdipDeleteStringFormat
GdipCloneBrush
GdipRotateWorldTransform
GdipSetTextRenderingHint
GdipCreateFromHDC
GdipResetWorldTransform
GdipDrawString
GdipCreateFontFromDC
GdipGetPenBrushFill
GdipSetSmoothingMode
GdipDeleteBrush
GdipCreateFontFromLogfontA
GdipSetCompositingQuality
GdipCreateStringFormat
GdipCreateBitmapFromFile
GdipGetImageEncodersSize

ws2_32

WSAGetLastError
setsockopt
connect
socket
inet_addr
closesocket
WSAIoctl
recv
listen
select
bind
accept
__WSAFDIsSet
WSASocketW
WSAStartup
WSAGetOverlappedResult
WSARecvFrom
WSARecv
WSAWaitForMultipleEvents
WSASendTo
WSASetLastError
WSACreateEvent
WSACloseEvent
ntohl
WSASend
htons
gethostbyname
getsockname
sendto
send
WSAEnumNetworkEvents
recvfrom
WSAEventSelect
inet_ntoa
getnameinfo
WSACleanup
ioctlsocket
htonl
getsockopt
ntohs
getaddrinfo
getpeername
shutdown
gethostname
WSAResetEvent
freeaddrinfo

netapi32

NetShareGetInfo
NetUserEnum
NetUserGetInfo
NetShareDel
Netbios
NetUserDel
NetUserSetInfo
NetApiBufferFree
NetShareAdd

iphlpapi

GetExtendedUdpTable
GetExtendedTcpTable
GetAdaptersInfo
GetAdaptersAddresses

mpr

WNetEnumResourceW
WNetCloseEnum
WNetOpenEnumW
WNetGetConnectionW

mapi32

ord198
ord59
ord11
ord13
ord15
ord21
ord23
ord75
ord135
ord129
ord140
ord17

powrprof

ReadPwrScheme
SetActivePwrScheme
DeletePwrScheme
GetActivePwrScheme
SetSuspendState
WritePwrScheme

wtsapi32

WTSQuerySessionInformationW
WTSFreeMemory
WTSEnumerateSessionsW
WTSQueryUserToken

userenv

DestroyEnvironmentBlock
RefreshPolicyEx
CreateEnvironmentBlock
ExpandEnvironmentStringsForUserW

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

psapi

EnumProcesses
GetModuleFileNameExW

wininet

InternetCrackUrlW

crypt32

CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertOpenSystemStoreW
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertEnumCertificatesInStore
CertOpenStore
CertFindCertificateInStore
CertCloseStore
CertFreeCertificateContext

wintrust

WinVerifyTrust

imagehlp

UnMapAndLoad
MapAndLoad
ImageRemoveCertificate

dbghelp

MiniDumpWriteDump

setupapi

SetupDiSetDeviceRegistryPropertyW
CM_Reenumerate_DevNode_Ex
CM_Disconnect_Machine
CM_Locate_DevNode_ExW
CM_Connect_MachineW
SetupDiGetINFClassW
SetupDiCreateDeviceInfoList
SetupDiOpenClassRegKeyExW
SetupCopyOEMInfW
SetupDiClassNameFromGuidExW
SetupScanFileQueueW
SetupOpenFileQueue
CM_Get_Next_Res_Des_Ex
SetupCloseInfFile
CM_Get_Res_Des_Data_Ex
SetupDiOpenDevRegKey
SetupDiDestroyDriverInfoList
SetupCloseFileQueue
SetupDiEnumDriverInfoW
SetupDiSetSelectedDriverW
CM_Get_First_Log_Conf_Ex
SetupDiGetDriverInfoDetailW
CM_Get_Res_Des_Data_Size_Ex
SetupDiBuildDriverInfoList
SetupGetStringFieldW
SetupOpenInfFileW
CM_Free_Res_Des_Handle
SetupDiSetDeviceInstallParamsW
SetupFindFirstLineW
CM_Free_Log_Conf_Handle
SetupDiGetDriverInstallParamsW
SetupDiGetClassDevsA
SetupDiGetDeviceRegistryPropertyA
SetupDiGetClassDescriptionA
SetupDiDestroyDeviceInfoList
CM_Get_DevNode_Status
CM_Enable_DevNode
CM_Disable_DevNode
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiBuildClassInfoListExW
SetupDiGetClassDescriptionExW
SetupDiGetClassDevsW
SetupDiSetClassInstallParamsW
SetupDiCallClassInstaller
SetupDiGetDeviceInstallParamsW
SetupDiGetClassDevsExW
SetupDiGetDeviceInstanceIdW
SetupDiRemoveDevice
SetupDiClassGuidsFromNameExW
CM_Get_Device_ID_ExW
SetupDiGetDeviceInfoListDetailW
SetupDiCreateDeviceInfoListExW
CM_Get_DevNode_Status_Ex
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoW

pdh

PdhAddCounterW
PdhRemoveCounter
PdhOpenQueryW
PdhAddCounterA
PdhEnumObjectItemsA
PdhCloseQuery
PdhGetFormattedCounterValue
PdhCollectQueryData

wldap32

ord14
ord208
ord46
ord117
ord26
ord27
ord127
ord167
ord142
ord79
ord133
ord147
ord301
ord219
ord145
ord41
ord216

sfc

SfcIsFileProtected

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1012KB - Virtual size: 1011KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 208KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NShellExt32.dll
.dll regsvr32 windows:5 windows x86 arch:x86

ca3ba0f1da01df2d346d43b449e8f297

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5e:f5:ed:d8:11:72:34:3d:cd:f1:a8:90:c8:5c:3f:07:72:40:19:7f:e5:08:81:38:f2:ec:b1:dd:d3:ec:3e:51
Signer

Actual PE Digest

5e:f5:ed:d8:11:72:34:3d:cd:f1:a8:90:c8:5c:3f:07:72:40:19:7f:e5:08:81:38:f2:ec:b1:dd:d3:ec:3e:51

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\NShellExt32.pdb

Imports

kernel32

GetModuleHandleExW
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
PeekNamedPipe
GetStdHandle
GetFileType
WaitForMultipleObjects
RtlUnwind
CompareFileTime
QueryPerformanceFrequency
SleepEx
QueueUserAPC
SetFilePointerEx
GetSystemDirectoryA
OpenProcess
DeviceIoControl
FindNextFileW
FormatMessageA
GetSystemTime
LockFileEx
CreateFileMappingA
HeapCompact
GetSystemInfo
GetVersionExA
DeleteFiber
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnmapViewOfFile
UnlockFileEx
GetFullPathNameA
InterlockedCompareExchange
HeapCreate
TryEnterCriticalSection
AreFileApisANSI
GetModuleFileNameA
DeleteFileA
GetPrivateProfileStringA
GetComputerNameW
SetFileAttributesA
CreateFileA
GetVolumeInformationA
GetDriveTypeA
MoveFileExW
ReleaseMutex
QueryDosDeviceW
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetLocalTime
GetExitCodeProcess
CreateProcessW
CreateMutexW
GetDriveTypeW
GetDiskFreeSpaceExW
GetLogicalDrives
OutputDebugStringW
GetCPInfo
GetStringTypeW
LCMapStringW
SwitchToThread
InterlockedFlushSList
GetVersion
CreateFiber
SwitchToFiber
ConvertFiberToThread
ConvertThreadToFiber
FlushViewOfFile
HeapQueryInformation
ExitThread
FreeLibraryAndExitThread
GetCommandLineA
GetCommandLineW
VirtualAlloc
VirtualQuery
SetStdHandle
ExitProcess
WriteConsoleW
SetConsoleCtrlHandler
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleCP
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
CreateDirectoryW
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
GlobalMemoryStatus
ResetEvent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetUserDefaultLCID
GetTempFileNameW
GetDiskFreeSpaceW
SearchPathW
GetProfileIntW
GetTempPathW
VerifyVersionInfoW
VerSetConditionMask
GetWindowsDirectoryW
SystemTimeToTzSpecificLocalTime
SetFileAttributesW
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
FindResourceExW
GetCurrentDirectoryW
lstrcpyW
GetCurrentProcess
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindFirstFileW
FindClose
DeleteFileW
SystemTimeToFileTime
VirtualProtect
GetUserDefaultUILanguage
GetLocaleInfoW
lstrcmpA
ResumeThread
SetThreadPriority
CreateEventW
SetEvent
GlobalGetAtomNameW
GlobalFlags
WideCharToMultiByte
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
GetModuleHandleA
FreeResource
GetSystemDirectoryW
GetCurrentThreadId
OutputDebugStringA
CopyFileW
FormatMessageW
MulDiv
LocalFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
LockResource
SetLastError
SetThreadLocale
GetThreadLocale
EncodePointer
DisableThreadLibraryCalls
CreateFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
WaitForSingleObject
CreateThread
MultiByteToWideChar
FindResourceW
LoadLibraryExW
lstrcmpiW
SizeofResource
LoadResource
LeaveCriticalSection
EnterCriticalSection
HeapSize
HeapReAlloc
HeapDestroy
InterlockedDecrement
InterlockedIncrement
LoadLibraryA
GetProcessHeap
HeapFree
HeapAlloc
GetProcAddress
GetVersionExW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryW
OpenMutexW
GetTickCount
CloseHandle
Sleep
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
TerminateThread
RaiseException
GetCurrentProcessId
FreeLibrary
GetEnvironmentVariableA
DecodePointer

user32

RegisterWindowMessageW
DispatchMessageW
PeekMessageW
GetMessagePos
GetMessageTime
PostMessageW
CallWindowProcW
RegisterClassW
GetClassInfoW
GetClassInfoExW
CreateWindowExW
IsWindow
IsMenu
IsChild
DestroyWindow
SetWindowPos
GetWindowPlacement
SetWindowPlacement
InflateRect
CopyRect
GetSysColor
GetMenuItemInfoW
DestroyMenu
RemoveMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
GetCursorPos
MessageBoxW
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
IsWindowVisible
IsIconic
GetDlgCtrlID
DestroyCursor
GetWindowRgn
CreateMenu
SubtractRect
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
GetUpdateRect
GetWindowRect
AppendMenuW
GetDlgItem
DefWindowProcW
SendMessageW
LoadImageW
SetMenuItemInfoW
SetMenuInfo
InsertMenuW
EnableMenuItem
CreatePopupMenu
CharNextW
GetIconInfo
DrawIconEx
DestroyIcon
SetRect
ReleaseDC
SystemParametersInfoW
SetFocus
GetFocus
GetProcessWindowStation
GetUserObjectInformationW
wsprintfA
wsprintfW
GetKeyState
GetCapture
EnableWindow
GetMenu
SetMenu
GetDC
UpdateWindow
SetActiveWindow
GetForegroundWindow
SetForegroundWindow
BeginPaint
EndPaint
ValidateRect
RedrawWindow
GetSystemMetrics
SetScrollPos
IsClipboardFormatAvailable
CharUpperBuffW
RegisterClipboardFormatW
ModifyMenuW
GetDoubleClickTime
SetMenuDefaultItem
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
SetPropW
GetPropW
RemovePropW
GetWindowTextW
GetWindowTextLengthW
GetClientRect
AdjustWindowRectEx
ScreenToClient
MapWindowPoints
LockWindowUpdate
CopyAcceleratorTableW
DestroyAcceleratorTable
EqualRect
PtInRect
GetWindowLongW
SetWindowLongW
GetClassLongW
GetParent
CreateAcceleratorTableW
GetKeyboardState
GetClassNameW
GetTopWindow
GetLastActivePopup
ToUnicodeEx
GetWindow
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
MapVirtualKeyExW
LoadIconW
SetScrollInfo
IsCharLowerW
GetKeyboardLayout
WaitMessage
GetScrollInfo
WinHelpW
PostThreadMessageW
GetComboBoxInfo
MonitorFromWindow
ReuseDDElParam
GetMonitorInfoW
GetKeyNameTextW
MapVirtualKeyW
IsWindowEnabled
GetWindowThreadProcessId
GetSysColorBrush
LoadCursorW
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
GetWindowDC
ClientToScreen
FillRect
IntersectRect
SetWindowTextW
GetDesktopWindow
RealChildWindowFromPoint
CheckMenuItem
SetMenuItemBitmaps
UnpackDDElParam
GetMenuCheckMarkDimensions
LoadBitmapW
CopyImage
ShowWindow
MoveWindow
InsertMenuItemW
TranslateAcceleratorW
LoadAcceleratorsW
CheckDlgButton
IsDialogMessageW
SendDlgItemMessageA
SetRectEmpty
OffsetRect
GetMessageW
TranslateMessage
GetActiveWindow
PostQuitMessage
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
GetAsyncKeyState
MapDialogRect
LoadMenuW
CharUpperW
TrackMouseEvent
MonitorFromPoint
UpdateLayeredWindow
UnionRect
DrawIcon
FrameRect
CopyIcon
SetCursorPos
BringWindowToTop
GetSystemMenu
IsZoomed
InvalidateRect
ShowOwnedPopups
DrawFrameControl
DrawEdge
DrawStateW
EmptyClipboard
SetCursor
DeleteMenu
SetTimer
KillTimer
GetNextDlgGroupItem
SetCapture
ReleaseCapture
WindowFromPoint
ScrollWindow
ExitWindowsEx
TrackPopupMenu
DrawFocusRect
IsRectEmpty
MessageBeep
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
GetMenuDefaultItem
SetLayeredWindowAttributes
EnumDisplayMonitors
SetClassLongW
SetWindowRgn
SetParent
OpenClipboard
CloseClipboard
SetClipboardData

gdi32

GetClipBox
ExcludeClipRect
Escape
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateBitmap
PatBlt
CreateRectRgnIndirect
SetTextColor
SetBkColor
ExtTextOutW
GetObjectW
GetTextExtentPoint32W
CreateFontIndirectW
SetMapMode
GetDeviceCaps
CreateDCW
CopyMetaFileW
CreateDIBSection
SelectObject
GetDIBits
DeleteObject
DeleteDC
CreateCompatibleDC
GetTextFaceW
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
GetObjectType
MoveToEx
TextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CombineRgn
SetRectRgn
DPtoLP
GetTextMetricsW
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetPixel
StretchBlt
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
GetRgnBox
OffsetRgn
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetPixel
GetStockObject
GetViewportExtEx
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetBkMode
GetWindowOrgEx
GetViewportOrgEx
BitBlt

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegQueryValueExW
QueryServiceStatus
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
CloseServiceHandle
RegSetValueExW
RegQueryInfoKeyW
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
ConvertSidToStringSidW
RegOpenKeyExA
FreeSid
OpenProcessToken
RegQueryValueExA
EqualSid
ConvertSidToStringSidA
AdjustTokenPrivileges
LookupPrivilegeValueW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CryptEnumProvidersW
CryptReleaseContext
CryptDestroyKey
CryptGetProvParam
CryptAcquireContextW
CryptGetUserKey
CryptExportKey
CryptDestroyHash
CryptSignHashW
CryptSetHashParam
CryptCreateHash
CryptDecrypt
CryptGenRandom
SetFileSecurityW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

shell32

ShellExecuteExW
DragQueryFileW
SHGetFileInfoW
ShellExecuteW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
SHGetDesktopFolder
DragFinish
SHBrowseForFolderW
SHAppBarMessage
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHCreateDirectoryExA

ole32

CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
ReleaseStgMedium
CoCreateInstance
StringFromGUID2
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
CoSetProxyBlanket
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CoInitializeEx
CreateStreamOnHGlobal
CoCreateGuid
CoInitialize
CoUninitialize
CoDisconnectObject
OleDuplicateData

oleaut32

VarBstrFromDate
VariantCopy
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
UnRegisterTypeLi
RegisterTypeLi
SysAllocString
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysFreeString

shlwapi

PathIsNetworkPathW
SHDeleteValueW
StrToIntExA
PathRemoveFileSpecW
StrFormatKBSizeW
PathStripToRootW
PathIsUNCW
PathFindExtensionW
PathFindFileNameW
SHDeleteKeyW
PathMatchSpecW
PathIsDirectoryW
SHGetValueW
SHGetValueA
PathFileExistsW
PathAppendW
wnsprintfW
wnsprintfA
wvnsprintfW
wvnsprintfA
PathFindFileNameA
StrCmpIW
SHSetValueA
PathFileExistsA

gdiplus

GdiplusShutdown
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc

msimg32

TransparentBlt
AlphaBlend

comctl32

CreatePropertySheetPageW
DestroyPropertySheetPage

uxtheme

IsThemeBackgroundPartiallyTransparent
IsAppThemed
GetWindowTheme
GetThemeSysColor
GetThemeColor
DrawThemeBackground
CloseThemeData
OpenThemeData
DrawThemeParentBackground
GetThemePartSize
GetCurrentThemeName
DrawThemeText

winmm

PlaySoundW

ws2_32

WSAStartup
ntohs
getsockopt
getsockname
getpeername
WSAEventSelect
WSAEnumNetworkEvents
send
WSACleanup
__WSAFDIsSet
bind
select
closesocket
WSACloseEvent
WSACreateEvent
WSASetLastError
inet_addr
socket
connect
recv
htons
setsockopt
WSAGetLastError
gethostbyname
inet_ntoa
gethostname
accept
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
WSAIoctl
ioctlsocket
getnameinfo
shutdown

crypt32

CertGetEnhancedKeyUsage
CertEnumCertificatesInStore
CertOpenStore
CertFindCertificateInStore
CertOpenSystemStoreW
CertCloseStore
CertFreeCertificateContext
CertGetIntendedKeyUsage
CertDuplicateCertificateContext
CertGetCertificateContextProperty

wldap32

ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord301
ord26

oleacc

AccessibleObjectFromWindow
LresultFromObject
CreateStdAccessibleObject

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

iphlpapi

GetAdaptersAddresses

netapi32

Netbios

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 792KB - Virtual size: 791KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 65KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 425KB - Virtual size: 424KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 214KB - Virtual size: 213KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NsLogon.exe
.exe windows:5 windows x86 arch:x86

7657e9d4b1bb3369da43f80e29335d54

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

54:49:af:d0:24:a2:33:3a:26:7d:26:14:b2:9f:77:b3:ff:7c:75:2f:52:1a:c5:1b:f3:df:b8:bd:7d:ad:d8:54
Signer

Actual PE Digest

54:49:af:d0:24:a2:33:3a:26:7d:26:14:b2:9f:77:b3:ff:7c:75:2f:52:1a:c5:1b:f3:df:b8:bd:7d:ad:d8:54

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Release\Client\NsLogon.pdb

Imports

kernel32

WriteFile
ReadFile
SizeofResource
EnterCriticalSection
HeapFree
GetCurrentProcessId
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
LocalFree
CloseHandle
WaitForSingleObjectEx
LeaveCriticalSection
GetFileAttributesExA
GetLastError
Sleep
CreateFileA
CreateEventW
LockResource
HeapReAlloc
RaiseException
CreateThread
LoadResource
FindResourceW
HeapAlloc
GetLocalTime
DecodePointer
HeapDestroy
DeleteCriticalSection
GetProcessHeap
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
HeapSize
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
GetCurrentThreadId
WaitForSingleObject
CreateMutexW
ExitProcess
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
GetEnvironmentVariableA
CompareFileTime
QueryPerformanceFrequency
MoveFileExW
GetConsoleCP
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
ReadConsoleW
GetFileAttributesW
GetModuleFileNameW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
FreeLibraryAndExitThread
ExitThread
WriteConsoleW
GetModuleHandleExW
GetStdHandle
InterlockedPushEntrySList
RtlUnwind
SleepEx
QueueUserAPC
TerminateThread
LoadLibraryExW
FileTimeToSystemTime
FormatMessageW
WideCharToMultiByte
SetLastError
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
EncodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
LoadLibraryW
GetCurrentDirectoryW
GetACP
FreeResource
MulDiv
GetFileSize
CreateFileW
GetFileType
SetFilePointer
SetFileTime
DuplicateHandle
SystemTimeToFileTime
DosDateTimeToFileTime
CreateDirectoryW
InterlockedIncrement
InterlockedDecrement
GlobalAlloc
GlobalLock
GlobalUnlock
GetLogicalDrives
SetFileAttributesW
GetDriveTypeW
GetDriveTypeA
GetVolumeInformationA
SetFileAttributesA
GetComputerNameW
GetPrivateProfileStringA
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
DeleteFileA
GetSystemDirectoryW
OpenMutexW
GetModuleFileNameA
InitializeCriticalSection
ReleaseMutex
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
GetVersionExW
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
GetVersionExA
DeleteFileW
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
FreeLibrary
GetSystemTime
FormatMessageA
FlushFileBuffers
GetFileSizeEx
GetSystemDirectoryA
SetFilePointerEx
FindFirstFileW
FindNextFileW
DeviceIoControl
FindClose
GetModuleHandleA
OpenProcess
SystemTimeToTzSpecificLocalTime

user32

CharNextW
GetDesktopWindow
PostQuitMessage
SetWindowLongW
SwitchDesktop
RegisterHotKey
SetTimer
ShowWindow
SetWindowPos
SendMessageW
SetThreadDesktop
GetThreadDesktop
CloseDesktop
SetCursor
PtInRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
PostMessageW
CreateWindowExW
GetKeyState
DestroyWindow
CreateDesktopW
IsIconic
SetFocus
GetActiveWindow
GetFocus
SetCapture
ReleaseCapture
KillTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
GetCursorPos
ScreenToClient
MapWindowPoints
IntersectRect
UnionRect
IsRectEmpty
GetParent
GetWindow
wvsprintfW
OffsetRect
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
GetSysColor
DefWindowProcW
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
EnableWindow
SetPropW
GetPropW
MonitorFromWindow
GetMonitorInfoW
CharPrevW
DrawTextW
FillRect
SetRect
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
MoveWindow
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
wsprintfA
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
UnregisterHotKey
IsWindowVisible
GetWindowLongW
IsWindow
GetWindowRect

gdi32

SelectObject
CreateDIBSection
CreateCompatibleDC
DeleteDC
GetObjectW
DeleteObject
BitBlt
CreateCompatibleBitmap
CreateFontIndirectW
CreatePen
GetStockObject
Rectangle
RestoreDC
SaveDC
GetTextMetricsW
SetWindowOrgEx
GetObjectA
GetDeviceCaps
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateRoundRectRgn
CreateSolidBrush
GetCharABCWidthsW
GetClipBox
GetTextExtentPoint32W
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
CreatePatternBrush
GdiFlush
SetBkMode
StretchBlt
SetStretchBltMode
SetTextColor
MoveToEx
ExtTextOutW
TextOutW

advapi32

OpenProcessToken
RegQueryValueExA
SetFileSecurityW
RegOpenKeyExA
RegCloseKey
RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
SetSecurityDescriptorDacl
GetTokenInformation
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegQueryValueExW
ConvertSidToStringSidW
ConvertStringSecurityDescriptorToSecurityDescriptorW

ole32

CreateStreamOnHGlobal
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoCreateGuid
CoUninitialize
CoInitialize

gdiplus

GdipCreateBitmapFromScan0
GdipGetImageWidth
GdipDeleteGraphics
GdipGetImageGraphicsContext
GdipCloneBrush
GdipCreateFromHDC
GdipFree
GdipFillPath
GdipCreatePath
GdipSetSmoothingMode
GdipDisposeImage
GdipDeletePath
GdipCreateTexture
GdipGetFamily
GdipDrawImageRectI
GdipAlloc
GdipDeleteBrush
GdipAddPathEllipseI
GdipCloneImage
GdipCreateLineBrushI
GdipSetCompositingQuality
GdipSetPixelOffsetMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipGraphicsClear
GdipDrawImage
GdipDeleteFontFamily
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipCreateStringFormat
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipGetImageHeight
GdipLoadImageFromFile
GdiplusShutdown
GdiplusStartup

shlwapi

wnsprintfW
PathFindExtensionA
SHGetValueA
PathFindFileNameA
PathFileExistsA
PathFileExistsW
wvnsprintfA
wnsprintfA
SHSetValueA
StrToIntExA
PathAppendW
StrStrIA
PathFindFileNameW

imm32

ImmSetCompositionWindow
ImmSetCompositionFontW
ImmGetVirtualKey
ImmGetContext
ImmReleaseContext

ws2_32

recvfrom
freeaddrinfo
getaddrinfo
listen
htonl
accept
select
__WSAFDIsSet
ntohs
getsockopt
getsockname
getpeername
WSAStartup
WSACleanup
WSAResetEvent
WSAEventSelect
ioctlsocket
getnameinfo
shutdown
sendto
gethostname
inet_ntoa
gethostbyname
WSAGetLastError
setsockopt
htons
recv
WSAWaitForMultipleEvents
connect
socket
inet_addr
WSASetLastError
WSACreateEvent
WSACloseEvent
closesocket
WSAIoctl
bind
send
WSAEnumNetworkEvents

comctl32

_TrackMouseEvent
ord17

iphlpapi

GetAdaptersAddresses

netapi32

Netbios

crypt32

CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertCloseStore

wldap32

ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145

shell32

SHCreateDirectoryExA
SHGetSpecialFolderPathW
SHCreateDirectoryExW

oleaut32

VariantClear
VariantInit
SysFreeString
SysAllocString

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 565KB - Virtual size: 565KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NtDesUtil.dll
.dll regsvr32 windows:6 windows x86 arch:x86

9fabe9c16306f27500d95d22d94758da

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9e:cf:47:60:d1:7b:eb:ce:53:5b:fa:62:04:16:81:83:16:23:53:81:14:01:a1:d7:7d:2d:b1:57:09:6f:d6:f4
Signer

Actual PE Digest

9e:cf:47:60:d1:7b:eb:ce:53:5b:fa:62:04:16:81:83:16:23:53:81:14:01:a1:d7:7d:2d:b1:57:09:6f:d6:f4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\UM_FESF\Release\NtDesUtil.pdb

Imports

ntdll

RtlUnwind
NtCreateFile

kernel32

EncodePointer
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
lstrcmpiW
MultiByteToWideChar
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
GetVolumePathNamesForVolumeNameW
CloseHandle
DeviceIoControl
WaitForSingleObject
OpenEventW
FindResourceExW
LockResource
LocalFree
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetConsoleMode
GetConsoleOutputCP
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
CreateFileW
WriteConsoleW
WriteFile
FlushFileBuffers
SetStdHandle
SetFilePointerEx
GetStringTypeW
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
IsDebuggerPresent
OutputDebugStringW
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType

user32

CharNextW

advapi32

ConvertStringSidToSidW
RegQueryValueExW
GetLengthSid
CopySid
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

ole32

CoCreateInstance
CoTaskMemFree
CoCreateFreeThreadedMarshaler
StringFromGUID2
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

SafeArrayGetVartype
SafeArrayCopy
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayCreate
SysAllocStringByteLen
SysStringByteLen
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysAllocString
SysFreeString
VariantClear
SysStringLen

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NtDeshs.exe
.exe windows:5 windows x86 arch:x86

d236baf16afbe2d6549faf3447f74862

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ea:dc:ee:12:b2:d5:d3:a6:c3:cf:0e:9c:16:2f:c9:f4:6b:70:45:6f:61:e6:d0:0d:6c:4e:30:df:a9:b9:e8:32
Signer

Actual PE Digest

ea:dc:ee:12:b2:d5:d3:a6:c3:cf:0e:9c:16:2f:c9:f4:6b:70:45:6f:61:e6:d0:0d:6c:4e:30:df:a9:b9:e8:32

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Release\Client\NtDeshs.pdb

Imports

kernel32

MoveFileExW
SetFileAttributesW
GetFileAttributesW
SetLastError
CreateThread
SetEvent
Sleep
CreateEventW
GetCurrentThreadId
InterlockedCompareExchange
GetCurrentProcess
GetCommandLineW
InterlockedExchange
LocalFree
CopyFileExW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
VirtualQuery
VirtualProtect
VirtualAlloc
GetSystemInfo
RtlUnwind
GetTickCount
CloseHandle
DeleteFileW
GetCurrentThread
ReleaseMutex
WaitForSingleObject
CreateMutexW
LoadLibraryExW
lstrcmpiW
InterlockedIncrement
SizeofResource
FreeLibrary
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
RaiseException
HeapReAlloc
GetLastError
MultiByteToWideChar
HeapSize
OpenProcess
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
InterlockedDecrement
EnterCriticalSection
HeapFree
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetFileType
CreateFileW
FindClose
WriteConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
WideCharToMultiByte
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
OutputDebugStringW
GetModuleFileNameA
GetFileSizeEx
WriteFile
OutputDebugStringA
CreateFileA
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
SetFilePointerEx
FindNextFileW

user32

CharNextW
PostThreadMessageW
GetMessageW
CharUpperW
MessageBoxW
LoadStringW
DispatchMessageW
TranslateMessage
wsprintfA

advapi32

GetSecurityDescriptorSacl
RevertToSelf
GetSecurityDescriptorDacl
GetAclInformation
GetAce
EqualSid
AllocateAndInitializeSid
GetSecurityDescriptorGroup
GetSidSubAuthority
GetSidLengthRequired
GetSecurityDescriptorControl
CopySid
InitializeSid
GetSecurityDescriptorOwner
IsValidSid
AddAce
SetThreadToken
CheckTokenMembership
InitializeAcl
DuplicateToken
ConvertSidToStringSidW
GetLengthSid
GetSecurityDescriptorLength
MakeSelfRelativeSD
GetTokenInformation
DeregisterEventSource
CreateServiceW
CloseServiceHandle
OpenSCManagerW
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCloseKey
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
ImpersonateSelf
GetNamedSecurityInfoW
SetNamedSecurityInfoW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExW
ReportEventW
RegisterEventSourceW
OpenServiceW
StartServiceCtrlDispatcherW
OpenProcessToken
ControlService
RegisterServiceCtrlHandlerW
DeleteService
SetServiceStatus

ole32

StringFromGUID2
CoRevokeClassObject
CoInitializeSecurity
CoResumeClassObjects
CoRegisterClassObject
CoCreateInstance
CoUninitialize
CoInitializeEx
CoReleaseServerProcess
CoAddRefServerProcess
CoRevertToSelf
CoImpersonateClient
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc

oleaut32

VarUI4FromStr
SysStringLen
SysFreeString
LoadTypeLi
LoadRegTypeLi
SysAllocString
RegisterTypeLi
UnRegisterTypeLi

shlwapi

wnsprintfA
wnsprintfW
PathFindFileNameA
wvnsprintfA
SHSetValueA
PathIsNetworkPathW
PathFileExistsW

userenv

UnloadUserProfile

winfscore

FesfUtil2ReadHeaderUnsafe_C
FesfUtil2UpdateHeaderUnsafe_C
FesfUtil2ReadHeaderExclusive_C
FesfUtil2IsFileFesfEncrypted_C
FesfUtil2UpdateHeaderExclusive_C

shell32

SHCreateDirectoryExA

Sections

.text
Size: 290KB - Virtual size: 290KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
NtDeshs2.dll
.dll windows:5 windows x86 arch:x86

f3628e33e412e24abe1a51b68dda8aab

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7a:4b:5a:81:8a:1b:9b:ee:bc:05:1f:ed:12:5e:92:4b:48:eb:7d:0a:1d:dd:9d:c4:ac:0d:81:ae:b1:d4:32:e5
Signer

Actual PE Digest

7a:4b:5a:81:8a:1b:9b:ee:bc:05:1f:ed:12:5e:92:4b:48:eb:7d:0a:1d:dd:9d:c4:ac:0d:81:ae:b1:d4:32:e5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\NtDeshs2.pdb

Imports

kernel32

HeapFree
InitializeCriticalSectionAndSpinCount
HeapSize
GetLastError
DisableThreadLibraryCalls
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
DeleteCriticalSection
GetProcessHeap
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
CloseHandle
CreateEventW
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType
GetStringTypeW
SetStdHandle
WriteFile
CreateFileW

winfscore

FesfUtil2IsFileFesfEncrypted_C

Exports

Exports

DesUtilIsEncryptedFile

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PolicyHandler.dll
.dll windows:5 windows x86 arch:x86

ac049ce89b97ccbc7dcd85dcc74645b3

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a5:6a:82:9d:61:bd:f4:40:2b:4b:60:53:21:c3:3b:93:a5:5b:75:48:3b:79:30:7d:75:65:7f:e3:5f:25:f3:bf
Signer

Actual PE Digest

a5:6a:82:9d:61:bd:f4:40:2b:4b:60:53:21:c3:3b:93:a5:5b:75:48:3b:79:30:7d:75:65:7f:e3:5f:25:f3:bf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\PolicyHandler.pdb

Imports

kernel32

ProcessIdToSessionId
WaitForSingleObjectEx
CreateWaitableTimerW
SetWaitableTimer
CopyFileW
ResetEvent
CreateEventW
SetEvent
GetCurrentProcessId
GetLocalTime
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryW
GetFileSize
GetCurrentDirectoryW
GetSystemTime
MoveFileW
GetTickCount
SleepEx
MoveFileExW
QueueUserAPC
CloseHandle
GetLastError
SetFileAttributesW
GetFileAttributesW
CreateFileW
WaitForSingleObject
GetCurrentProcess
SetEndOfFile
InitializeCriticalSection
LeaveCriticalSection
SystemTimeToFileTime
OpenProcess
GetSystemWindowsDirectoryW
GetVolumeInformationW
WriteFile
EnterCriticalSection
GetFileSizeEx
GetLogicalDrives
LocalFileTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
FindFirstFileW
FindNextFileW
FindClose
GetModuleHandleW
OutputDebugStringA
SystemTimeToTzSpecificLocalTime
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
ReadFile
CreateDirectoryW
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
QueryPerformanceFrequency
WriteConsoleW
SetStdHandle
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
GetFileType
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
SetConsoleCtrlHandler
FreeLibraryAndExitThread
FormatMessageW
WideCharToMultiByte
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
Sleep
DeleteFileW
TerminateThread
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
HeapFree
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
LockFile
SetFilePointer
GetFullPathNameA
UnlockFileEx
GetTempPathW
CreateMutexW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
HeapReAlloc
GetSystemInfo
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LocalFree
LockFileEx
GetProcessHeap
FormatMessageA
CreateFileMappingW
MapViewOfFile
FlushFileBuffers
OpenFileMappingW
QueryDosDeviceW
InterlockedDecrement
ReleaseMutex
RaiseException
GetDiskFreeSpaceExW
GetDriveTypeW
MoveFileExA
GetDriveTypeA
GetVolumeInformationA
SetFileAttributesA
GetComputerNameW
GetPrivateProfileStringA
CreatePipe
GetSystemDirectoryW
CreateProcessW
OpenMutexW
GetExitCodeProcess
SizeofResource
LockResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameA
lstrcpynW
DeviceIoControl
RemoveDirectoryW
LocalAlloc
GetModuleHandleA
FreeResource
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
ReadProcessMemory
lstrlenW
GetSystemDirectoryA
SetFilePointerEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateTimerQueue
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread

user32

IsWindowVisible
GetDC
GetWindowRect
EnumDisplaySettingsW
EnumDisplayDevicesW
GetMonitorInfoW
EnumDisplayMonitors
CharUpperW
GetProcessWindowStation
MessageBoxW
EnumWindows
OpenInputDesktop
LoadCursorW
GetUserObjectInformationW
GetSystemMetrics
DrawIconEx
GetDesktopWindow
IsIconic
ReleaseDC
GetCursorPos
wsprintfA
wsprintfW
FindWindowExW
CloseDesktop
SetThreadDesktop
GetThreadDesktop
IsWindow
GetClassNameW
GetForegroundWindow
GetWindowThreadProcessId
GetWindowTextW

advapi32

RegSetValueExW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
DuplicateTokenEx
RegOpenKeyExA
RegCloseKey
RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
RegQueryValueExA
EqualSid
ConvertSidToStringSidA
SetFileSecurityW
AllocateAndInitializeSid
RegQueryInfoKeyW
SetSecurityDescriptorDacl
GetTokenInformation
LookupAccountNameW
RegQueryValueExW
LookupAccountSidW
ConvertSidToStringSidW
CreateProcessAsUserW
FreeSid
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
OpenProcessToken
ImpersonateLoggedOnUser
RevertToSelf
AdjustTokenPrivileges
LookupPrivilegeValueW
GetUserNameW
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHGetFolderPathW
SHCreateDirectoryExA

shlwapi

StrToIntExA
StrCmpIW
PathAddBackslashW
PathIsDirectoryW
StrStrIA
PathFileExistsA
SHSetValueA
wnsprintfA
PathFindFileNameW
StrStrIW
PathFileExistsW
wnsprintfW
SHSetValueW
SHDeleteValueW
PathAppendW
PathIsNetworkPathW
PathFindExtensionW
wvnsprintfW
wvnsprintfA
SHEnumKeyExW
PathFindFileNameA

sfc

SfcIsFileProtected

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

netapi32

Netbios

ws2_32

WSACloseEvent
closesocket
WSASetLastError
inet_addr
WSAIoctl
bind
send
WSAEnumNetworkEvents
WSAEventSelect
socket
connect
WSAWaitForMultipleEvents
recv
htons
ioctlsocket
getnameinfo
shutdown
WSACreateEvent
getpeername
getsockname
getsockopt
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
setsockopt
WSAGetLastError
ntohs
inet_ntoa
WSAResetEvent
gethostbyname
gethostname
WSAStartup

iphlpapi

GetAdaptersAddresses

crypt32

CryptMsgClose
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertGetNameStringW

wldap32

ord41
ord216
ord14
ord46
ord219
ord145
ord301
ord147
ord133
ord79
ord142
ord167
ord208
ord127
ord27
ord26
ord117

wtsapi32

WTSQueryUserToken

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

EnumProcesses
GetModuleFileNameExW

wintrust

CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext
WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle
CryptCATCatalogInfoFromContext

gdi32

DeleteDC
GetDIBits
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
GetDeviceCaps
CreateDCW
DeleteObject
GetObjectW

ole32

CoCreateGuid
CoInitialize
CoUninitialize
CoSetProxyBlanket
CoCreateInstance

oleaut32

SysAllocString
SysFreeString

gdiplus

GdipGetImageEncoders
GdipAlloc
GdipCloneImage
GdipFree
GdipSaveImageToFile
GdipCreateBitmapFromFile
GdipGetImageEncodersSize
GdipDisposeImage

Exports

Exports

BurnFileTraceHandler
CleanExpiredTriggerCaptureRecords
DebugXHandler
IMMonitorPolicyHandlerEx
NFSProtocolFilterPolicyHandler
NetBIOSProtocolFilterPolicyHandler
OtherDesSupplierHandler
SoftWareComplianceHandler
SoftwareInstallCtrlHandler
TelnetProtocolFilterPolicyHandler
TimingDeleteFileHandler
TriggeredScreenCapturePolicyHandlerEx
WindowsSecurityPassWDHandler

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 549KB - Virtual size: 548KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
TrIDLib.dll
.dll windows:1 windows x86 arch:x86

870a08bec747528dd17bfa46c3bfec22

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a1:83:34:34:36:06:f1:0f:a9:97:18:61:30:86:0e:2d:62:f2:c4:9c:0f:17:c7:ec:9c:86:c3:28:ff:15:c3:ce
Signer

Actual PE Digest

a1:83:34:34:36:06:f1:0f:a9:97:18:61:30:86:0e:2d:62:f2:c4:9c:0f:17:c7:ec:9c:86:c3:28:ff:15:c3:ce

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

gdi32

MoveToEx

kernel32

CloseHandle
CreateFileA
ExitProcess
GetCommandLineA
GetFileSize
GetFileType
GetLastError
GetModuleHandleA
GetProcAddress
GetStartupInfoA
GetStringTypeA
GetVersionExA
GlobalAlloc
GlobalFree
GlobalReAlloc
LoadLibraryA
MultiByteToWideChar
ReadFile
SetEndOfFile
SetErrorMode
SetFilePointer
SetLastError
Sleep
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WideCharToMultiByte
WriteFile
RtlMoveMemory

ole32

CLSIDFromProgID
CoCreateInstance
CoInitialize
CoUninitialize
ProgIDFromCLSID

oleaut32

GetActiveObject
SafeArrayCreate
SysAllocStringByteLen
SysFreeString
SysStringByteLen
VariantClear
VariantCopy

user32

CharLowerBuffA
CharNextA
CharUpperBuffA
CreateDialogIndirectParamA
CreateDialogParamA
CreateWindowExA
DialogBoxIndirectParamA
DialogBoxParamA
GetWindow

Exports

Exports

TrID_Analyze
TrID_GetInfo
TrID_LoadDefsPack
TrID_SubmitFileA

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.link
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rloc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VFS32.dll
.dll windows:5 windows x86 arch:x86

aef429894405eb442874057c80213927

Code Sign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3b:fd:00:9d:7c:1a:93:46:30:02:78:bc:0b:e4:b1:d4:75:63:18:c1:28:f9:3d:66:1b:8a:cb:97:a4:bb:a0:bc
Signer

Actual PE Digest

3b:fd:00:9d:7c:1a:93:46:30:02:78:bc:0b:e4:b1:d4:75:63:18:c1:28:f9:3d:66:1b:8a:cb:97:a4:bb:a0:bc

Digest Algorithm

sha256

PE Digest Matches

true

3b:fd:00:9d:7c:1a:93:46:30:02:78:bc:0b:e4:b1:d4:75:63:18:c1:28:f9:3d:66:1b:8a:cb:97:a4:bb:a0:bc
Signer

Actual PE Digest

3b:fd:00:9d:7c:1a:93:46:30:02:78:bc:0b:e4:b1:d4:75:63:18:c1:28:f9:3d:66:1b:8a:cb:97:a4:bb:a0:bc

Digest Algorithm

sha256

PE Digest Matches

true

3b:fd:00:9d:7c:1a:93:46:30:02:78:bc:0b:e4:b1:d4:75:63:18:c1:28:f9:3d:66:1b:8a:cb:97:a4:bb:a0:bc
Signer

Actual PE Digest

3b:fd:00:9d:7c:1a:93:46:30:02:78:bc:0b:e4:b1:d4:75:63:18:c1:28:f9:3d:66:1b:8a:cb:97:a4:bb:a0:bc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

OpenServiceW
StartServiceW
OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
CreateServiceW

kernel32

InterlockedDecrement
LeaveCriticalSection
SetLastError
InterlockedIncrement
SetWaitableTimer
CreateWaitableTimerW
DeviceIoControl
WaitForMultipleObjects
GetCurrentThreadId
GetLastError
CloseHandle
SetNamedPipeHandleState
GetModuleFileNameW
CreateFileW
EnterCriticalSection
DefineDosDeviceW
TransactNamedPipe
WaitNamedPipeW
CancelIo
OutputDebugStringA
SetThreadPriority
InitializeCriticalSectionAndSpinCount
GetQueuedCompletionStatus
WaitForSingleObject
ResumeThread
CreateEventW
SetEvent
GetSystemInfo
CreateThread
DeleteCriticalSection
GetCurrentProcessId
CreateIoCompletionPort
WriteConsoleW
DecodePointer
OutputDebugStringW
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
InterlockedFlushSList
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
HeapFree
HeapAlloc
GetACP
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
WriteFile
GetConsoleCP
GetConsoleMode
SetFilePointerEx
FlushFileBuffers
RaiseException

shell32

SHChangeNotify

shlwapi

PathRemoveFileSpecW

desa32

ord37

Exports

Exports

UfsdDriverVersion
UfsdGetDeviceMountId
UfsdGetDeviceName
UfsdGetFilterStatus
UfsdMount
UfsdRegisterFSD
UfsdResetTimeout
UfsdSetAliveTimeout
UfsdStartFilter
UfsdStopFilter
UfsdUnRegisterFSD
UfsdUnRegisterFSDForName
UfsdUnmount
UfsdUpdateMirrorPath
UfsdVersion
_UfsdGetWorkThreadIds@12

Sections

.text
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinBurMon.dll
.dll windows:5 windows x86 arch:x86

7ccdf9923d4f3024990e9e4601341eef

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

35:de:9a:2c:63:63:7d:18:06:c9:e2:20:5d:1a:e6:aa:c0:f9:48:14:c8:ae:f6:7b:c4:af:f2:e8:96:6f:f9:13
Signer

Actual PE Digest

35:de:9a:2c:63:63:7d:18:06:c9:e2:20:5d:1a:e6:aa:c0:f9:48:14:c8:ae:f6:7b:c4:af:f2:e8:96:6f:f9:13

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\Nsec\Release\Client\WinBurMon.pdb

Imports

kernel32

CreateFileW
DeviceIoControl
GlobalMemoryStatus
SystemTimeToTzSpecificLocalTime
LocalAlloc
GetLogicalDriveStringsW
lstrlenW
GetTickCount
LocalFree
QueueUserAPC
ResetEvent
CloseHandle
WaitForSingleObjectEx
SetEvent
CreateEventW
OpenEventW
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
SleepEx
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
GetDriveTypeA
MoveFileExW
CreateDirectoryW
SetStdHandle
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
EnterCriticalSection
GetVolumeInformationW
GetLastError
FormatMessageW
WideCharToMultiByte
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleFileNameA
GetFileSizeEx
WriteFile
OutputDebugStringA
CreateFileA
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
SetFilePointerEx
ReadFile
FindFirstFileW
HeapFree
FindNextFileW
SetFilePointer
SetEndOfFile
GetTempPathW
FindClose
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
GetModuleHandleA
OpenProcess
SetFileAttributesW
GetFileAttributesExW
FileTimeToSystemTime
DeleteFileA
DeleteFileW
LoadLibraryW
HeapAlloc
GetProcessHeap
FreeLibrary
CreateFileMappingW
MapViewOfFile
LoadLibraryExW
Sleep
GetDriveTypeW
CreateMutexW
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
GetVersionExA
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSize
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
RtlUnwind
RaiseException
InterlockedFlushSList
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetStdHandle
GetFileType
WriteConsoleW
SetConsoleCtrlHandler
GetACP
GetCurrentDirectoryW

advapi32

ConvertSidToStringSidW
RegOpenKeyExW
InitializeSecurityDescriptor
OpenProcessToken
GetTokenInformation
RegQueryValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
SetSecurityDescriptorDacl
RegCloseKey
SetFileSecurityW
AllocateAndInitializeSid
SetEntriesInAclW

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
SafeArrayDestroy

shlwapi

StrStrIA
SHSetValueA
wnsprintfA
PathFileExistsW
PathAppendW
PathFindFileNameA
wvnsprintfA
wnsprintfW

crypt32

CertFreeCertificateContext
CertCloseStore
CertDuplicateCertificateContext
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CryptBinaryToStringW

ws2_32

recv
htons
setsockopt
WSAGetLastError
connect
socket
shutdown
sendto
WSASetLastError
WSACreateEvent
WSACloseEvent
ioctlsocket
getnameinfo
recvfrom
freeaddrinfo
getaddrinfo
closesocket
WSAIoctl
bind
gethostname
listen
htonl
accept
select
__WSAFDIsSet
WSACleanup
send
WSAEnumNetworkEvents
WSAEventSelect
getpeername
getsockname
getsockopt
ntohs
WSAStartup

wldap32

ord142
ord26
ord79
ord133
ord167
ord127
ord145
ord219
ord46
ord14
ord301
ord147
ord216
ord208
ord41
ord117
ord27

user32

GetProcessWindowStation
MessageBoxW
GetUserObjectInformationW
wsprintfA

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHCreateDirectoryExA

Exports

Exports

StartBurnTraceHelper
StopBurnTraceHelper

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 472KB - Virtual size: 472KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinDesPol.dll
.dll windows:5 windows x86 arch:x86

fa57bcdf868350c743e4fa7ab577dc1e

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

43:f2:53:71:b4:41:a0:2f:04:52:06:e5:1a:c2:a9:23:e3:85:11:b7:ed:92:0b:7a:29:1e:1b:38:2a:28:fe:44
Signer

Actual PE Digest

43:f2:53:71:b4:41:a0:2f:04:52:06:e5:1a:c2:a9:23:e3:85:11:b7:ed:92:0b:7a:29:1e:1b:38:2a:28:fe:44

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\WinDesPol.pdb

Imports

kernel32

DisableThreadLibraryCalls
Sleep
QueueUserWorkItem
SleepEx
GetWindowsDirectoryW
QueueUserAPC
WaitForSingleObjectEx
TerminateThread
CreateEventW
OpenProcess
OpenEventW
WaitForSingleObject
CloseHandle
InitializeCriticalSection
LeaveCriticalSection
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
EnterCriticalSection
DeleteCriticalSection
DecodePointer
RaiseException
CompareFileTime
MoveFileExW
CreateDirectoryW
SetStdHandle
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLastError
InitializeCriticalSectionAndSpinCount
FormatMessageW
WideCharToMultiByte
SetLastError
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
EncodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetModuleFileNameA
GetFileSizeEx
WriteFile
OutputDebugStringA
CreateFileA
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
SetFilePointerEx
ReadFile
GetLogicalDrives
FindFirstFileW
HeapFree
FindNextFileW
lstrcpynW
DeviceIoControl
GetDriveTypeA
SetFilePointer
SetEndOfFile
GetTempPathW
FindClose
GetVolumeInformationA
LocalAlloc
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
GetModuleHandleA
SetFileAttributesW
GetFileAttributesExW
FileTimeToSystemTime
DeleteFileA
DeleteFileW
LoadLibraryW
HeapAlloc
LocalFree
GetProcessHeap
FreeLibrary
CreateFileMappingW
MapViewOfFile
LoadLibraryExW
lstrlenW
GetFileSize
OutputDebugStringW
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
CreateMutexW
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
LoadLibraryA
GetVersionExA
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
CreateThread
OpenFileMappingA
SystemTimeToTzSpecificLocalTime
WritePrivateProfileStringA
GetComputerNameW
CreateDirectoryA
GetPrivateProfileStringA
GetDriveTypeW
GetModuleFileNameW
OpenMutexW
OpenFileMappingW
ReleaseMutex
RtlUnwind
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
ExitThread
FreeLibraryAndExitThread
GetStdHandle
GetFileType
WriteConsoleW
SetConsoleCtrlHandler
GetACP
GetDateFormatW
GetTimeFormatW
GetCurrentDirectoryW

user32

GetProcessWindowStation
GetUserObjectInformationW
CharUpperW
MessageBoxW
wsprintfA

shlwapi

PathFileExistsW
SHSetValueW
StrToIntExA
wnsprintfA
PathFindFileNameA
PathFileExistsA
PathAppendW
wnsprintfW
PathFindFileNameW
PathMatchSpecW
SHSetValueA
wvnsprintfA
PathAppendA
SHDeleteValueA

ws2_32

__WSAFDIsSet
WSAGetLastError
setsockopt
htons
recv
shutdown
getnameinfo
ioctlsocket
send
WSAEnumNetworkEvents
WSAEventSelect
WSACloseEvent
gethostbyname
inet_ntoa
gethostname
bind
WSAIoctl
getpeername
getsockname
getsockopt
ntohs
WSAStartup
WSACleanup
WSACreateEvent
select
accept
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
connect
socket
inet_addr
WSASetLastError
closesocket

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

crypt32

CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CryptMsgClose
CertDuplicateCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CertOpenStore
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFreeCertificateContext

wintrust

CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
CryptCATCatalogInfoFromContext
WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash

netapi32

Netbios

rpcrt4

UuidFromStringA

iphlpapi

GetAdaptersAddresses

wldap32

ord27
ord41
ord208
ord216
ord14
ord46
ord219
ord145
ord117
ord26
ord127
ord167
ord142
ord79
ord133
ord147
ord301

advapi32

OpenProcessToken
RegSetValueExW
GetTokenInformation
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExW
RegOpenKeyExA
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegQueryValueExA
RegCreateKeyExW

shell32

SHCreateDirectoryExA
SHCreateDirectoryExW
SHGetSpecialFolderPathW

Exports

Exports

DesPolGetKeyFromHeader
DesPolGetKeyNewFile
DesPolGetPolicyDirectoryListing
DesPolGetPolicyExistingFile
DesPolGetPolicyNewFile
InitDesPol

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 513KB - Virtual size: 513KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinDevInfo.dll
.dll windows:5 windows x86 arch:x86

e284d07c2aaf53e93959f5e720d8be76

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e3:11:3a:ff:a6:59:86:2e:f9:08:6c:44:fd:87:b3:2a:69:51:05:e8:0b:04:b7:e5:96:6c:49:57:f7:56:c5:51
Signer

Actual PE Digest

e3:11:3a:ff:a6:59:86:2e:f9:08:6c:44:fd:87:b3:2a:69:51:05:e8:0b:04:b7:e5:96:6c:49:57:f7:56:c5:51

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\Nsec\Release\Client\WinDevInfo.pdb

Imports

kernel32

FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FlushFileBuffers
GetConsoleCP
SetStdHandle
HeapSize
WriteConsoleW
InterlockedDecrement
CloseHandle
CreateFileW
FindFirstFileExA
HeapReAlloc
GetConsoleMode
GetFileType
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
GetLastError
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetLogicalDrives
HeapFree
WriteFile
DeviceIoControl
GetDriveTypeA
FindClose
GetVolumeInformationA
GetModuleHandleA
OpenProcess
CreateFileA
LoadLibraryW
HeapAlloc
LocalFree
GetProcessHeap
FreeLibrary
LoadLibraryExW
GetModuleFileNameA
GetFileSizeEx
OutputDebugStringA
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
SetFilePointerEx
GetComputerNameW
GetPrivateProfileStringA
RtlUnwind
RaiseException
InterlockedFlushSList
ExitProcess
GetModuleHandleExW

user32

wsprintfA
GetSystemMetrics

advapi32

GetTokenInformation
RegQueryValueExW
RegOpenKeyW
RegEnumKeyW
RegCloseKey
RegQueryValueExA
OpenProcessToken
RegOpenKeyExA
RegOpenKeyExW
ConvertSidToStringSidW

ole32

CoInitializeEx
CoInitializeSecurity
CoUninitialize
CoSetProxyBlanket
CoCreateInstance

oleaut32

SysAllocString
VariantClear
SysFreeString
VariantInit

shlwapi

PathFindFileNameW
PathFindFileNameA
SHSetValueA
wvnsprintfA
StrStrIW
wnsprintfW
wnsprintfA
PathAppendW
PathFileExistsA

ws2_32

gethostname
inet_ntoa
gethostbyname

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

shell32

SHCreateDirectoryExA

Exports

Exports

NxGetDevInfo
NxReleaseDevInfo

Sections

.text
Size: 252KB - Virtual size: 252KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinDevMon.dll
.dll windows:5 windows x86 arch:x86

da6cfff00da40d3683eec83d2cb63a7e

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:0c:f6:8d:e2:73:08:57:0b:f2:65:d1:28:db:cd:3c:14:4c:74:16:39:18:41:55:72:f2:5e:df:03:c9:2d:28
Signer

Actual PE Digest

6a:0c:f6:8d:e2:73:08:57:0b:f2:65:d1:28:db:cd:3c:14:4c:74:16:39:18:41:55:72:f2:5e:df:03:c9:2d:28

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\Nsec\Release\Client\WinDevMon.pdb

Imports

kernel32

HeapSize
SetStdHandle
GetConsoleCP
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
HeapReAlloc
GetConsoleMode
GetFileType
GetStdHandle
WriteConsoleW
DeleteCriticalSection
ResetEvent
WaitForSingleObjectEx
SetEvent
GetLastError
CreateEventW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetACP
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
ExitProcess
InterlockedFlushSList
RaiseException
RtlUnwind
WideCharToMultiByte
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleFileNameA
GetFileSizeEx
WriteFile
OutputDebugStringA
CreateFileA
GetSystemDirectoryA
CloseHandle
SetFileAttributesA
GetLocalTime
SetFilePointerEx
HeapFree
FindClose
CreateFileW
OpenProcess
HeapAlloc
LocalFree
GetProcessHeap
FreeLibrary
LoadLibraryExW

user32

UnregisterDeviceNotification
wsprintfA
RegisterDeviceNotificationW

setupapi

CM_Get_DevNode_Status
SetupDiOpenDeviceInfoA
SetupDiDestroyDeviceInfoList
SetupDiSetClassInstallParamsW
SetupDiCallClassInstaller
SetupDiCreateDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiGetClassDevsW
SetupDiGetDeviceInstanceIdA

shlwapi

wvnsprintfA
SHSetValueA
PathFindFileNameA
wnsprintfA

advapi32

GetTokenInformation
RegQueryValueExW
RegCloseKey
OpenProcessToken
RegOpenKeyExW
ConvertSidToStringSidW

shell32

SHCreateDirectoryExA

Exports

Exports

GetNxWinDevObject
NotifyNxWinDevMon
StartNxWinDevMon
StopNxWinDevMon

Sections

.text
Size: 100KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinDisTask.dll
.dll windows:5 windows x86 arch:x86

632cad7fe948981724b7150e8d929db1

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

57:69:b3:38:d6:63:6f:30:c7:fb:d5:0a:90:46:dd:fd:af:a4:ac:0b:e5:db:59:c7:26:99:80:21:3e:51:cc:8c
Signer

Actual PE Digest

57:69:b3:38:d6:63:6f:30:c7:fb:d5:0a:90:46:dd:fd:af:a4:ac:0b:e5:db:59:c7:26:99:80:21:3e:51:cc:8c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\Nsec\Release\Client\WinDisTask.pdb

Imports

kernel32

ResetEvent
SystemTimeToTzSpecificLocalTime
SleepEx
LocalFree
GetWindowsDirectoryW
GetLocalTime
QueueUserAPC
DeleteFileW
WaitForSingleObjectEx
GetDiskFreeSpaceExW
SetEvent
CreateEventW
ReleaseMutex
CreateMutexW
GetTempPathW
ReadFile
GetCurrentProcessId
CloseHandle
GetLastError
ProcessIdToSessionId
GetSystemDirectoryW
GetCurrentThreadId
CreateFileW
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
WaitForSingleObject
WriteFile
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
QueryPerformanceFrequency
MoveFileExW
CreateDirectoryW
SetStdHandle
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
SetConsoleCtrlHandler
FreeLibraryAndExitThread
ExitThread
CreateThread
WriteConsoleW
GetFileType
GetStdHandle
FormatMessageW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetVolumeInformationW
GetLogicalDrives
SetFileAttributesW
Sleep
GetDriveTypeW
MoveFileExA
CreateFileA
DeleteFileA
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
CreateProcessW
OpenMutexW
HeapFree
GetDriveTypeA
GetVolumeInformationA
HeapAlloc
SetFileAttributesA
GetComputerNameW
GetProcessHeap
GetPrivateProfileStringA
GetModuleFileNameA
InitializeCriticalSection
GetModuleFileNameW
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
GetVersionExA
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSize
SystemTimeToFileTime
FreeLibrary
GetSystemTime
FormatMessageA
FlushFileBuffers
CancelIo
FindFirstFileW
FindNextFileW
DeviceIoControl
FindClose
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
FileTimeToSystemTime
Process32FirstW
WTSGetActiveConsoleSessionId
LoadLibraryExW
GetFileSizeEx
GetSystemDirectoryA
SetFilePointerEx
RtlUnwind
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
GetCurrentDirectoryW

user32

GetThreadDesktop
CloseDesktop
GetProcessWindowStation
wsprintfW
wsprintfA
MessageBoxW
GetUserObjectInformationW

advapi32

RegSetValueExW
RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
RegCloseKey
ConvertSidToStringSidW
CreateProcessAsUserW
RegOpenKeyExA
SetSecurityDescriptorDacl
GetTokenInformation
RegQueryValueExW
CryptGenRandom
CryptDecrypt
CryptCreateHash
CreateProcessWithLogonW
ConvertStringSecurityDescriptorToSecurityDescriptorW
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
LookupPrivilegeValueW
SetFileSecurityW
EqualSid
RegQueryValueExA
SetTokenInformation
RegCreateKeyExW
OpenProcessToken
FreeSid
DuplicateTokenEx

shell32

ShellExecuteExW
SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHCreateDirectoryExA

shlwapi

SHSetValueA
StrStrIA
wnsprintfA
PathFileExistsW
wvnsprintfA
PathFindFileNameA
StrToIntExA
PathFileExistsA
wnsprintfW
PathFindExtensionW
PathFindFileNameW
PathAppendW
StrCmpIW

ws2_32

WSAGetOverlappedResult
setsockopt
gethostname
gethostbyname
inet_ntoa
send
closesocket
inet_addr
socket
connect
htons
WSAGetLastError
recv
ioctlsocket
getnameinfo
shutdown
WSARecv
WSAWaitForMultipleEvents
WSASetLastError
WSACreateEvent
WSACloseEvent
WSASend
WSAIoctl
bind
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
getpeername
getsockname
getsockopt
ntohs
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
getaddrinfo
freeaddrinfo
recvfrom
sendto
listen

iphlpapi

GetAdaptersAddresses

crypt32

CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty

wldap32

ord167
ord147
ord127
ord145
ord301
ord219
ord142
ord79
ord46
ord14
ord216
ord208
ord133
ord41
ord117
ord26
ord27

netapi32

NetUserAdd
NetUserEnum
NetApiBufferFree
Netbios
NetLocalGroupAddMembers

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

ole32

CoCreateGuid

Exports

Exports

WinDisTaskControlHandler

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 509KB - Virtual size: 508KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinDiskMgr.dll
.dll windows:5 windows x86 arch:x86

d8f4fcf09eb1d28038c98861bf79d1f7

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

14:b9:8f:42:97:83:61:89:78:d7:33:38:98:09:4d:c6:4f:a4:ba:2b:a4:90:5d:96:64:cc:b0:47:6c:95:f7:e3
Signer

Actual PE Digest

14:b9:8f:42:97:83:61:89:78:d7:33:38:98:09:4d:c6:4f:a4:ba:2b:a4:90:5d:96:64:cc:b0:47:6c:95:f7:e3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\WinDiskMgr.pdb

Imports

kernel32

DeleteCriticalSection
DisableThreadLibraryCalls
SystemTimeToTzSpecificLocalTime
GetTickCount
DeleteFileW
CreateFileW
GetVolumeInformationA
ProcessIdToSessionId
SetFilePointer
SleepEx
GetLastError
LocalFree
QueueUserAPC
ResetEvent
WaitForSingleObjectEx
SetEvent
CreateEventW
WaitForSingleObject
GetDriveTypeA
DeviceIoControl
GetCurrentProcessId
OpenMutexW
DeleteFileA
Sleep
QueueUserWorkItem
CreateMutexW
InitializeCriticalSection
LeaveCriticalSection
WriteFile
EnterCriticalSection
CloseHandle
CreateFileA
GetFileAttributesExA
CreateDirectoryW
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetLogicalDrives
ReadFile
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
MoveFileExW
QueryPerformanceFrequency
SetStdHandle
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
SetConsoleCtrlHandler
WriteConsoleW
FormatMessageW
WideCharToMultiByte
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
SetFileAttributesW
GetDriveTypeW
GetLocalTime
GetModuleFileNameW
HeapFree
HeapAlloc
SetFileAttributesA
GetComputerNameW
GetProcessHeap
GetPrivateProfileStringA
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
GetSystemDirectoryW
GetModuleFileNameA
ReleaseMutex
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
GetVersionExA
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSize
SystemTimeToFileTime
FreeLibrary
GetSystemTime
FormatMessageA
FlushFileBuffers
GetFileSizeEx
GetSystemDirectoryA
SetFilePointerEx
FindFirstFileW
FindNextFileW
QueryDosDeviceA
FindClose
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
FileTimeToSystemTime
Process32FirstW
LoadLibraryExW
TerminateThread
RtlUnwind
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetStdHandle
GetFileType
GetCurrentDirectoryW

advapi32

OpenProcessToken
RegCreateKeyExA
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
SetSecurityDescriptorDacl
GetTokenInformation
RegQueryValueExW
DuplicateTokenEx
ConvertSidToStringSidW
CreateProcessAsUserW
RegOpenKeyExW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExA
RegEnumKeyA
RegSetValueExA
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
LookupPrivilegeValueW
SetFileSecurityW
RegQueryValueExA

shlwapi

SHGetValueA
PathAppendW
PathFileExistsW
SHEnumKeyExA
PathAppendA
StrToIntExA
PathFindFileNameW
StrStrIA
SHDeleteValueA
SHEnumValueA
PathFindFileNameA
wvnsprintfA
PathAddBackslashA
wnsprintfA
SHEnumKeyExW
SHGetValueW
wnsprintfW
SHSetValueA
SHSetValueW
SHDeleteValueW
PathFileExistsA
SHDeleteKeyA

ws2_32

recv
htons
setsockopt
WSAGetLastError
gethostname
gethostbyname
inet_ntoa
getpeername
getsockname
getsockopt
socket
WSAEventSelect
inet_addr
ioctlsocket
getnameinfo
shutdown
WSAWaitForMultipleEvents
ntohs
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
WSASetLastError
WSACreateEvent
WSACloseEvent
closesocket
WSAIoctl
bind
WSAResetEvent
send
WSAEnumNetworkEvents
connect
htonl

iphlpapi

GetAdaptersAddresses

crypt32

CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore

wldap32

ord79
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145
ord301
ord147
ord133
ord142
ord167

netapi32

Netbios

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

user32

GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
wsprintfA

shell32

SHCreateDirectoryExA
SHGetSpecialFolderPathW
SHCreateDirectoryExW

ole32

CoCreateGuid

Exports

Exports

CheckCryptVolume
DiskCryptPolicyHandler
DiskCryptPolicyHandlerEx
GetUDFriendlyName
GetUDiskTypeIDA
GetVirtualVolumeList
InitDiskCryptImlp
IsRegisteredUDisk
IsUSBDrive
IsVirtualVolume
MountVolume
ROUD_FsFltRestartHandlerEx
ReadUDiskIDA
ReadUDiskIDAEx
StartUsbInsertAndExtractCheckService
UDiskAccessCtrlHandlerEx
UDiskAlertPolicyHandlerEx
UnmountVolume
UpdateDiskCryptKEY
WriteUDiskIDA
WriteUDiskIDAEx

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 522KB - Virtual size: 521KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinDteCore32.dll
.dll windows:5 windows x86 arch:x86

24820ed7ab7ee83b584cad598cbdb3fb

Code Sign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

66:a5:70:3f:80:d6:f1:8c:a4:29:bf:da:16:f9:2a:26:56:82:d7:1e:e5:cc:09:89:46:9c:02:c1:9e:d2:2e:09
Signer

Actual PE Digest

66:a5:70:3f:80:d6:f1:8c:a4:29:bf:da:16:f9:2a:26:56:82:d7:1e:e5:cc:09:89:46:9c:02:c1:9e:d2:2e:09

Digest Algorithm

sha256

PE Digest Matches

true

66:a5:70:3f:80:d6:f1:8c:a4:29:bf:da:16:f9:2a:26:56:82:d7:1e:e5:cc:09:89:46:9c:02:c1:9e:d2:2e:09
Signer

Actual PE Digest

66:a5:70:3f:80:d6:f1:8c:a4:29:bf:da:16:f9:2a:26:56:82:d7:1e:e5:cc:09:89:46:9c:02:c1:9e:d2:2e:09

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\WinDteCore32.pdb

Imports

kernel32

FindFirstFileW
FindFirstFileExW
FindNextFileW
FindClose
DuplicateHandle
LockFile
UnlockFileEx
LockFileEx
MapViewOfFile
MoveFileWithProgressW
MoveFileW
DeleteFileW
GetFileAttributesW
SetFileAttributesW
ReadFile
CreateFileW
OutputDebugStringW
ReadFileEx
ReadFileScatter
ReplaceFileW
WriteFileEx
WriteFileGather
GetTempPathW
OpenFileMappingW
CopyFileExW
CopyFileW
TlsFree
TlsGetValue
TlsAlloc
TlsSetValue
DeleteCriticalSection
InitializeCriticalSection
GetCompressedFileSizeW
EnterCriticalSection
DisableThreadLibraryCalls
GetModuleFileNameW
GetTickCount
SetEndOfFile
GetShortPathNameW
GetCurrentProcessId
MoveFileExW
SetFilePointerEx
SetEvent
CreateFileA
GetFileAttributesExW
ReleaseMutex
CreateMutexW
GetFileSizeEx
LoadLibraryExW
FreeLibrary
GetModuleHandleW
GetProcAddress
MapViewOfFileEx
CreateFileMappingW
GetFileSize
UnmapViewOfFile
SetFilePointer
WriteFile
VirtualQuery
SetThreadContext
FlushInstructionCache
GetThreadContext
GetCurrentThread
SuspendThread
GetCurrentThreadId
VirtualAlloc
LeaveCriticalSection
GetFileInformationByHandle
InterlockedCompareExchange
GetCurrentProcess
VirtualFree
VirtualProtect
GetExitCodeProcess
VirtualQueryEx
IsWow64Process
CreateProcessW
ReadProcessMemory
ExitProcess
VirtualAllocEx
VirtualProtectEx
DecodePointer
GetTimeZoneInformation
GetCurrentDirectoryW
SetStdHandle
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetStringTypeW
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetACP
WriteConsoleW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
RtlUnwind
InterlockedFlushSList
RaiseException
EncodePointer
OpenFileMappingA
SystemTimeToTzSpecificLocalTime
SetFileTime
FlushFileBuffers
GetSystemTime
SystemTimeToFileTime
CreateFileMappingA
UnlockFile
HeapDestroy
HeapCompact
GetSystemInfo
HeapReAlloc
GetVersionExA
WaitForSingleObjectEx
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
HeapSize
HeapValidate
GetFullPathNameA
GetDiskFreeSpaceW
GetFullPathNameW
CloseHandle
GetLastError
OpenProcess
ResumeThread
WaitForSingleObject
GetEnvironmentVariableW
TerminateProcess
SetLastError
WriteProcessMemory
HeapCreate
TryEnterCriticalSection
AreFileApisANSI
GetSystemDirectoryA
ResetEvent
OutputDebugStringA
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
HeapFree
HeapAlloc
SetFileAttributesA
GetProcessHeap
Sleep
GetDriveTypeW
GetModuleFileNameA
GetLocalTime
LocalFree
OpenMutexW
DeleteFileA
FormatMessageA
VerSetConditionMask
SleepEx
VerifyVersionInfoA
WaitForMultipleObjects
GetFileType
GetStdHandle
PeekNamedPipe
LoadLibraryA
QueryDosDeviceW
lstrcpynW
GetVersionExW
GetModuleHandleA
CreateEventW
FileTimeToSystemTime
LoadLibraryW

user32

GetMessageW
DispatchMessageA
CallNextHookEx
IsWindow
UnhookWindowsHookEx
DefWindowProcA
CreateWindowExA
TranslateMessage
LoadIconW
LoadCursorW
PostQuitMessage
RegisterClassExA
UpdateWindow
SetWindowsHookExW
CharUpperW
wsprintfA

gdi32

GetStockObject

advapi32

RegCloseKey
RegOpenKeyExW
CryptAcquireContextA
CryptReleaseContext
CryptDestroyKey
CryptGetHashParam
CryptImportKey
CryptEncrypt
CryptCreateHash
CryptHashData
CryptDestroyHash
GetTokenInformation
RegQueryValueExW
ConvertSidToStringSidW
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegSetValueExA
RegCreateKeyExA

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExA

ole32

CoCreateInstance
OleCreateFromFile
OleCreateLinkEx
OleCreateLink
OleCreateLinkToFileEx
OleCreateLinkToFile
StgOpenStorageEx
StgOpenStorage
OleCreateFromFileEx

shlwapi

StrToIntExA
PathFindFileNameA
wvnsprintfA
SHDeleteValueA
PathAppendW
SHSetValueA
PathAppendA
PathAddBackslashW
StrCmpNIW
wvnsprintfW
PathMatchSpecW
PathFindFileNameW
wnsprintfW
wnsprintfA

ws2_32

__WSAFDIsSet
select
WSASetLastError
recv
send
accept
freeaddrinfo
htons
getaddrinfo
ioctlsocket
sendto
recvfrom
gethostname
WSAStartup
WSACleanup
listen
WSAIoctl
socket
setsockopt
ntohs
bind
closesocket
connect
getpeername
getsockname
getsockopt
WSAGetLastError

wldap32

ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord60
ord211
ord46
ord143

sfc

SfcIsFileProtected

rpcrt4

UuidFromStringA

Exports

Exports

DetourFinishHelperProcess
InstallHook
UninstallHook

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 197KB - Virtual size: 197KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinFsCore.dll
.dll windows:6 windows x86 arch:x86

5ac6d0ed858d2dd0e1b971dde61ca5e0

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c0:2e:29:79:0d:a4:e6:eb:65:f6:17:b1:de:65:e1:6b:34:6f:79:6f:8a:63:f6:86:0c:31:15:ff:b5:22:07:64
Signer

Actual PE Digest

c0:2e:29:79:0d:a4:e6:eb:65:f6:17:b1:de:65:e1:6b:34:6f:79:6f:8a:63:f6:86:0c:31:15:ff:b5:22:07:64

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\UM_FESF\Release\WinFsCore.pdb

Imports

mpr

WNetGetUniversalNameW

ntdll

NtCreateFile
NtQueryInformationFile
NtQueryEaFile
NtSetEaFile
RtlNtStatusToDosError
RtlUnwind

kernel32

WriteFile
DeviceIoControl
CreateFileW
GetConsoleCP
GetEnvironmentVariableW
GetCurrentProcessId
ReadFile
SetLastError
DeleteFileW
SetFilePointerEx
LocalFree
ReplaceFileW
GetVolumePathNamesForVolumeNameW
MoveFileW
FlushFileBuffers
CloseHandle
GetCurrentThread
GetLastError
GetCurrentProcess
GetConsoleOutputCP
GetConsoleMode
SetStdHandle
GetFileSizeEx
HeapSize
WriteConsoleW
SetFileInformationByHandle
UnhandledExceptionFilter
GetProcessHeap
MultiByteToWideChar
FormatMessageA
GetCPInfoExW
InitOnceComplete
InitOnceBeginInitialize
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
GetStringTypeW
GetCPInfo
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW

advapi32

SetNamedSecurityInfoW
GetNamedSecurityInfoW
RegGetValueW
CopySid
ConvertStringSidToSidW
IsValidSid
GetLengthSid
LookupPrivilegeValueW
AdjustTokenPrivileges
PrivilegeCheck
OpenProcessToken
OpenThreadToken

Exports

Exports

??0FEU2Exception@@QAE@KJ@Z
?FesfUtil2FixFileTag@@YAXV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?FesfUtil2GetBuildStamp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?FesfUtil2GetExecutablePathForThreadId@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@I@Z
?FesfUtil2GetFileSize@@YA_KV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?FesfUtil2GetFullyQualifiedPath@@YA?AU?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@std@@U_GUID@@V?$basic_string_view@_WU?$char_traits@_W@std@@@2@@Z
?FesfUtil2GetSidForThreadId@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@I@Z
?FesfUtil2GetUniversalFilePath@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$basic_string_view@_WU?$char_traits@_W@std@@@2@@Z
?FesfUtil2GetVersion@@YA?AU?$pair@II@std@@XZ
?FesfUtil2IsFileFesfEncrypted@@YA_NV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?FesfUtil2IsThreadIdInSid@@YA_NIV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?FesfUtil2PurgePolicyCache@@YAXI@Z
?FesfUtil2PurgePolicyCache@@YAXV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?FesfUtil2ReadHeaderExclusive@@YA?AUFESF_UTIL2_SOLUTION_HEADER@@V?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?FesfUtil2ReadHeaderUnsafe@@YA?AUFESF_UTIL2_SOLUTION_HEADER@@V?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?FesfUtil2UpdateHeaderExclusive@@YAXV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@ABUFESF_UTIL2_SOLUTION_HEADER@@@Z
?FesfUtil2UpdateHeaderExclusiveWithExtension@@YAXV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@ABUFESF_UTIL2_SOLUTION_HEADER@@ABV12@@Z
?FesfUtil2UpdateHeaderUnsafe@@YAXV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@ABUFESF_UTIL2_SOLUTION_HEADER@@@Z
?GetMessageString@FEU2Exception@@QBE?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?IsNativeError@FEU2Exception@@QBE_NXZ
?NtStatus@FEU2Exception@@QBEKXZ
?ThrowFromNtError@FEU2Exception@@SAXJ@Z
?ThrowFromWin32Error@FEU2Exception@@SAXK@Z
?Win32Error@FEU2Exception@@QBEKXZ
?what@FEU2Exception@@UBEPBDXZ
FesfUtil2FixFileTag_C
FesfUtil2GetExecutablePathForThreadId_C
FesfUtil2GetFileSize_C
FesfUtil2GetFullyQualifiedPath_C
FesfUtil2GetSidForThreadId_C
FesfUtil2GetUniversalFilePath_C
FesfUtil2GetVersion_C
FesfUtil2IsFileFesfEncrypted_C
FesfUtil2IsThreadIdInSid_C
FesfUtil2PurgePolicyCacheForFile_C
FesfUtil2PurgePolicyCacheForThreadId_C
FesfUtil2ReadHeaderExclusive_C
FesfUtil2ReadHeaderUnsafe_C
FesfUtil2UpdateHeaderExclusiveWithExtension_C
FesfUtil2UpdateHeaderExclusive_C
FesfUtil2UpdateHeaderUnsafe_C

Sections

.text
Size: 243KB - Virtual size: 243KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 190KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinImDeca.dll
.dll windows:5 windows x86 arch:x86

f76e30b52d835ca88a533885eab2b27b

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6d:78:3f:69:d7:bd:ea:a6:f0:51:90:50:79:5c:15:6f:20:54:6c:b2:55:65:df:19:88:25:71:41:2b:02:7c:ca
Signer

Actual PE Digest

6d:78:3f:69:d7:bd:ea:a6:f0:51:90:50:79:5c:15:6f:20:54:6c:b2:55:65:df:19:88:25:71:41:2b:02:7c:ca

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\WinImDeca.pdb

Imports

kernel32

SystemTimeToTzSpecificLocalTime
DisableThreadLibraryCalls
SystemTimeToFileTime
GetLocalTime
FileTimeToSystemTime
lstrlenW
LoadLibraryExW
FreeLibrary
GetModuleHandleW
GetProcAddress
CreateFileMappingW
GetModuleFileNameW
GetFileSize
UnmapViewOfFile
SetFilePointer
WriteFile
VirtualQuery
SetThreadContext
FlushInstructionCache
GetThreadContext
GetCurrentThread
SuspendThread
GetCurrentThreadId
VirtualAlloc
InterlockedCompareExchange
GetCurrentProcess
VirtualFree
VirtualProtect
VirtualQueryEx
ReadProcessMemory
ExitProcess
VirtualProtectEx
CloseHandle
GetLastError
OpenProcess
ResumeThread
WaitForSingleObject
GetEnvironmentVariableA
GetEnvironmentVariableW
TerminateProcess
SetLastError
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
CompareFileTime
MoveFileExW
CreateDirectoryW
DecodePointer
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
OpenMutexW
GetTickCount
OpenFileMappingW
MapViewOfFile
ReadFile
CreateMutexW
LocalFree
GetModuleFileNameA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetLogicalDrives
HeapFree
GetDriveTypeA
GetVolumeInformationA
CreateFileA
HeapAlloc
SetFileAttributesA
GetComputerNameW
GetProcessHeap
GetPrivateProfileStringA
SetFileAttributesW
Sleep
GetDriveTypeW
DeleteFileA
ReleaseMutex
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateFileW
GetFileAttributesW
GetVersionExW
HeapValidate
HeapSize
MultiByteToWideChar
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
DeleteCriticalSection
WideCharToMultiByte
GetSystemTime
FormatMessageA
FlushFileBuffers
GetFileSizeEx
GetSystemDirectoryA
SetFilePointerEx
FindFirstFileW
FindNextFileW
DeviceIoControl
FindClose
GetModuleHandleA
CreateEventW
TerminateThread
QueueUserAPC
SleepEx
RtlUnwind
RaiseException
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetFileType
GetModuleHandleExW
WriteConsoleW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetACP
GetConsoleMode
ReadConsoleW
GetStringTypeW
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetCurrentDirectoryW

shlwapi

PathAppendW
PathFileExistsW
SHGetValueW
SHDeleteValueA
wvnsprintfA
PathAppendA
PathFileExistsA
SHSetValueW
StrCmpNW
SHSetValueA
PathFindFileNameA
wnsprintfW
StrToIntExA
PathFindFileNameW
wnsprintfA

iphlpapi

GetAdaptersAddresses

netapi32

Netbios

ws2_32

connect
recv
htons
setsockopt
WSAGetLastError
gethostname
gethostbyname
socket
getsockopt
ntohs
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
inet_addr
WSASetLastError
getsockname
WSACloseEvent
closesocket
WSAIoctl
bind
getpeername
send
WSAEnumNetworkEvents
WSAEventSelect
inet_ntoa
ioctlsocket
getnameinfo
shutdown
WSACreateEvent
htonl

crypt32

CertDuplicateCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFreeCertificateContext

wldap32

ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145

user32

MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
wsprintfA

advapi32

RegQueryValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
RegCloseKey
SetSecurityDescriptorDacl
GetTokenInformation
RegQueryValueExW
SetFileSecurityW
ConvertSidToStringSidW
RegOpenKeyExA
OpenProcessToken
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
DeregisterEventSource
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW

shell32

SHCreateDirectoryExW
SHCreateDirectoryExA
SHGetSpecialFolderPathW

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 486KB - Virtual size: 486KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinImDeca_Test.dll
.dll windows:5 windows x86 arch:x86

f76e30b52d835ca88a533885eab2b27b

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9c:a4:0b:9d:c8:13:fa:ac:ba:6a:79:2b:75:de:d0:25:a4:bf:cb:2c:de:ab:ef:1b:33:a0:4a:e2:c3:f7:a0:2e
Signer

Actual PE Digest

9c:a4:0b:9d:c8:13:fa:ac:ba:6a:79:2b:75:de:d0:25:a4:bf:cb:2c:de:ab:ef:1b:33:a0:4a:e2:c3:f7:a0:2e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\WinImDeca_Test.pdb

Imports

kernel32

SystemTimeToTzSpecificLocalTime
DisableThreadLibraryCalls
SystemTimeToFileTime
GetLocalTime
FileTimeToSystemTime
lstrlenW
LoadLibraryExW
FreeLibrary
GetModuleHandleW
GetProcAddress
CreateFileMappingW
GetModuleFileNameW
GetFileSize
UnmapViewOfFile
SetFilePointer
WriteFile
VirtualQuery
SetThreadContext
FlushInstructionCache
GetThreadContext
GetCurrentThread
SuspendThread
GetCurrentThreadId
VirtualAlloc
InterlockedCompareExchange
GetCurrentProcess
VirtualFree
VirtualProtect
VirtualQueryEx
ReadProcessMemory
ExitProcess
VirtualProtectEx
CloseHandle
GetLastError
OpenProcess
ResumeThread
WaitForSingleObject
GetEnvironmentVariableA
GetEnvironmentVariableW
TerminateProcess
SetLastError
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
CompareFileTime
MoveFileExW
CreateDirectoryW
DecodePointer
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
OpenMutexW
GetTickCount
OpenFileMappingW
MapViewOfFile
ReadFile
CreateMutexW
LocalFree
GetModuleFileNameA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetLogicalDrives
HeapFree
GetDriveTypeA
GetVolumeInformationA
CreateFileA
HeapAlloc
SetFileAttributesA
GetComputerNameW
GetProcessHeap
GetPrivateProfileStringA
SetFileAttributesW
Sleep
GetDriveTypeW
DeleteFileA
ReleaseMutex
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateFileW
GetFileAttributesW
GetVersionExW
HeapValidate
HeapSize
MultiByteToWideChar
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
DeleteCriticalSection
WideCharToMultiByte
GetSystemTime
FormatMessageA
FlushFileBuffers
GetFileSizeEx
GetSystemDirectoryA
SetFilePointerEx
FindFirstFileW
FindNextFileW
DeviceIoControl
FindClose
GetModuleHandleA
CreateEventW
TerminateThread
QueueUserAPC
SleepEx
RtlUnwind
RaiseException
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetFileType
GetModuleHandleExW
WriteConsoleW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetACP
GetConsoleMode
ReadConsoleW
GetStringTypeW
SetConsoleCtrlHandler
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetCurrentDirectoryW

shlwapi

PathAppendW
PathFileExistsW
SHGetValueW
SHDeleteValueA
wvnsprintfA
PathAppendA
PathFileExistsA
SHSetValueW
StrCmpNW
SHSetValueA
PathFindFileNameA
wnsprintfW
StrToIntExA
PathFindFileNameW
wnsprintfA

iphlpapi

GetAdaptersAddresses

netapi32

Netbios

ws2_32

connect
recv
htons
setsockopt
WSAGetLastError
gethostname
gethostbyname
socket
getsockopt
ntohs
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
inet_addr
WSASetLastError
getsockname
WSACloseEvent
closesocket
WSAIoctl
bind
getpeername
send
WSAEnumNetworkEvents
WSAEventSelect
inet_ntoa
ioctlsocket
getnameinfo
shutdown
WSACreateEvent
htonl

crypt32

CertDuplicateCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFreeCertificateContext

wldap32

ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145

user32

MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
wsprintfA

advapi32

RegQueryValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
RegCloseKey
SetSecurityDescriptorDacl
GetTokenInformation
RegQueryValueExW
SetFileSecurityW
ConvertSidToStringSidW
RegOpenKeyExA
OpenProcessToken
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
DeregisterEventSource
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW

shell32

SHCreateDirectoryExW
SHCreateDirectoryExA
SHGetSpecialFolderPathW

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 486KB - Virtual size: 486KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 86KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinMrkx32.dll
.dll windows:5 windows x86 arch:x86

b9e031fa21cba4f43240c0b3ba05c0e7

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8d:c4:f7:c6:a2:af:db:16:11:99:85:80:e1:61:42:a9:3e:ae:e6:0b:34:2b:f1:7a:56:09:4a:1f:09:99:a8:0d
Signer

Actual PE Digest

8d:c4:f7:c6:a2:af:db:16:11:99:85:80:e1:61:42:a9:3e:ae:e6:0b:34:2b:f1:7a:56:09:4a:1f:09:99:a8:0d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\WinMrkx32.pdb

Imports

kernel32

CreateFileA
GetFileAttributesExA
ReadFile
Sleep
LoadLibraryExW
FreeLibrary
GetModuleHandleW
GetProcAddress
GetComputerNameW
GetFileSize
UnmapViewOfFile
SetFilePointer
WriteFile
VirtualQuery
SetThreadContext
FlushInstructionCache
GetThreadContext
GetCurrentThread
GetCurrentProcessId
CreateFileMappingW
SuspendThread
GetCurrentThreadId
VirtualAlloc
GetCurrentProcess
VirtualFree
VirtualProtect
VirtualQueryEx
SystemTimeToTzSpecificLocalTime
DisableThreadLibraryCalls
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
ExitProcess
VirtualProtectEx
CloseHandle
GetLastError
OpenProcess
ResumeThread
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
CompareFileTime
SleepEx
MoveFileExW
SetStdHandle
DecodePointer
GetTimeZoneInformation
InterlockedCompareExchange
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
WaitForSingleObject
GetEnvironmentVariableA
GetEnvironmentVariableW
TerminateProcess
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
GetStringTypeW
ReadConsoleW
GetConsoleMode
GetACP
FreeLibraryAndExitThread
ExitThread
CreateThread
WriteConsoleW
SetLastError
GetModuleHandleExW
GetFileType
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
InterlockedFlushSList
RaiseException
RtlUnwind
SetFilePointerEx
GetSystemDirectoryA
GetFileSizeEx
FileTimeToSystemTime
CreateEventW
GetModuleHandleA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetLocalTime
GetTickCount
GetLogicalDrives
HeapFree
GetDriveTypeA
GetVolumeInformationA
HeapAlloc
SetFileAttributesA
GetProcessHeap
GetPrivateProfileStringA
SetFileAttributesW
GetDriveTypeW
CreateMutexW
LocalFree
GetModuleFileNameW
GetModuleFileNameA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
MapViewOfFile
DeleteFileA
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateFileW
GetFileAttributesW
GetVersionExW
HeapValidate
HeapSize
MultiByteToWideChar
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
DeleteCriticalSection
SystemTimeToFileTime
WideCharToMultiByte
GetSystemTime
FormatMessageA
FlushFileBuffers
TerminateThread
FindFirstFileW
FindNextFileW
DeviceIoControl
FindClose
GetCurrentDirectoryW

user32

GetMessageW
CallNextHookEx
DefWindowProcW
GetDC
UnhookWindowsHookEx
SetWindowsHookExW
IsWindowVisible
SetWindowPos
SendMessageW
UnregisterClassW
RegisterClassExW
ShowWindow
DispatchMessageW
TranslateMessage
GetDesktopWindow
LoadIconW
LoadCursorW
GetClassNameW
UpdateLayeredWindow
PostQuitMessage
GetClassInfoExW
ReleaseDC
EnableWindow
GetWindowThreadProcessId
CreateDialogParamW
GetWindowRect
CreateWindowExW
CreateWindowExA
GetParent
GetAncestor
IsWindow
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
SetWindowLongW
GetWindowLongW
wsprintfA
EndPaint
BeginPaint
UpdateWindow
RegisterClassW
SetLayeredWindowAttributes

gdi32

CreateCompatibleDC
CreateDIBSection
SelectObject
CreateSolidBrush
CreateFontW
GetStockObject
GetTextMetricsW
DeleteDC
DeleteObject
GetObjectA
CreatePen
SetBkMode
Ellipse
GdiFlush

advapi32

RegQueryValueExA
ConvertSidToStringSidA
RegOpenKeyExW
RegCloseKey
GetTokenInformation
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExA
OpenProcessToken
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
GetUserNameW

shlwapi

PathAppendW
PathFileExistsW
SHSetValueA
PathFileExistsA
wnsprintfW
PathFindFileNameA
StrStrIW
wnsprintfA
wvnsprintfA

gdiplus

GdipSetStringFormatAlign
GdipCreatePen1
GdipDeletePen
GdipTranslateWorldTransform
GdipDeleteFont
GdipDeleteStringFormat
GdipDeleteGraphics
GdipCloneBrush
GdipRotateWorldTransform
GdipSetTextRenderingHint
GdipCreateFromHDC
GdipResetWorldTransform
GdipDrawString
GdipFree
GdipCreateFontFromDC
GdipGetPenBrushFill
GdipSetSmoothingMode
GdipAlloc
GdipDeleteBrush
GdipCreateFontFromLogfontA
GdipSetCompositingQuality
GdipCreateStringFormat
GdiplusShutdown
GdiplusStartup
GdipFillEllipseI
GdipGetPenFillType
GdipCreateSolidFill

netapi32

Netbios
NetUserGetInfo
NetApiBufferFree

iphlpapi

GetAdaptersAddresses

ws2_32

listen
getaddrinfo
WSAGetLastError
recvfrom
sendto
select
__WSAFDIsSet
WSACleanup
WSAStartup
setsockopt
ntohs
getsockopt
getsockname
htonl
gethostname
getpeername
WSAEventSelect
WSAEnumNetworkEvents
send
bind
gethostbyname
inet_ntoa
ioctlsocket
getnameinfo
shutdown
htons
recv
connect
socket
WSAIoctl
closesocket
WSACloseEvent
WSACreateEvent
WSASetLastError
accept
freeaddrinfo

crypt32

CertFreeCertificateContext
CertCloseStore
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFindCertificateInStore
CertDuplicateCertificateContext

wldap32

ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord41
ord208
ord216
ord14
ord46
ord219
ord145
ord117

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExA
SHCreateDirectoryExW

ole32

CoCreateGuid

Exports

Exports

StartWindowWatermark
StopWindowWatermark

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 468KB - Virtual size: 467KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinNetGuard32.dll
.dll windows:5 windows x86 arch:x86

4821865b64457ad1f59674e9a74a17ba

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:38:e1:b4:2f:0f:ea:ab:47:64:88:68:bc:98:49:4b:7c:d7:a8:76:43:4a:63:92:9b:da:ec:67:68:5e:a1:9f
Signer

Actual PE Digest

05:38:e1:b4:2f:0f:ea:ab:47:64:88:68:bc:98:49:4b:7c:d7:a8:76:43:4a:63:92:9b:da:ec:67:68:5e:a1:9f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\WinNetGuard32.pdb

Imports

kernel32

ResetEvent
SystemTimeToTzSpecificLocalTime
DisableThreadLibraryCalls
SleepEx
FreeLibrary
GetCurrentProcessId
DeleteCriticalSection
LocalFree
GetProcAddress
QueueUserAPC
LoadLibraryW
TerminateThread
GetLastError
CreateEventW
InitializeCriticalSection
WaitForMultipleObjects
SetLastError
CreateProcessW
GlobalMemoryStatus
ConvertThreadToFiber
CloseHandle
WaitForSingleObject
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
GetEnvironmentVariableA
CompareFileTime
QueryPerformanceFrequency
MoveFileExW
CreateDirectoryW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
CreateProcessA
GetConsoleCP
ReadConsoleW
GetConsoleMode
FormatMessageW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
ReadFile
CreatePipe
CreateMutexW
GetSystemDirectoryW
GetExitCodeProcess
GetLogicalDrives
SetFileAttributesW
Sleep
GetDriveTypeW
HeapFree
GetDriveTypeA
GetVolumeInformationA
CreateFileA
HeapAlloc
SetFileAttributesA
GetComputerNameW
GetProcessHeap
GetPrivateProfileStringA
WriteFile
SetEvent
DeleteFileA
OpenFileMappingW
GetLocalTime
CreateFileMappingW
MapViewOfFile
GetModuleFileNameA
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileW
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSize
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
FindFirstFileW
FindNextFileW
DeviceIoControl
FindClose
GetModuleHandleA
OpenProcess
FileTimeToSystemTime
LoadLibraryExW
GetFileSizeEx
GetSystemDirectoryA
SetFilePointerEx
RtlUnwind
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
WriteConsoleW
CreateThread
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCurrentDirectoryW

advapi32

RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
RegCloseKey
SetSecurityDescriptorDacl
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExA
RegQueryValueExW
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
SetFileSecurityW
RegQueryValueExA
OpenProcessToken
ConvertSidToStringSidW

ole32

CoCreateGuid

shlwapi

PathAppendW
SHSetValueA
StrStrIA
wnsprintfA
PathFileExistsA
PathFindFileNameA
PathFileExistsW
wnsprintfW
wvnsprintfA

iphlpapi

GetIpInterfaceEntry
GetAdaptersAddresses
CreateUnicastIpAddressEntry
InitializeIpForwardEntry
InitializeIpInterfaceEntry
InitializeUnicastIpAddressEntry
CreateIpForwardEntry2
SetIpInterfaceEntry

netapi32

Netbios

ws2_32

inet_addr
socket
connect
WSAWaitForMultipleEvents
recv
setsockopt
WSAGetLastError
gethostbyname
WSASetLastError
gethostname
inet_pton
htons
WSACleanup
__WSAFDIsSet
select
accept
listen
shutdown
getaddrinfo
freeaddrinfo
recvfrom
sendto
WSACreateEvent
WSACloseEvent
WSAStartup
closesocket
WSAIoctl
bind
ntohs
send
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
getpeername
getsockname
inet_ntoa
getsockopt
ioctlsocket
getnameinfo
htonl

crypt32

CertOpenStore
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptStringToBinaryA
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty

wldap32

ord301
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145
ord147

user32

GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
wsprintfA

shell32

SHCreateDirectoryExA
SHGetSpecialFolderPathW
SHCreateDirectoryExW

Exports

Exports

ConnectToVPNServer
DisConnectToVPNServer
InitializeVPNService
VPNPolicyHandlerEx

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 496KB - Virtual size: 495KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinNtDes.dll
.dll windows:5 windows x86 arch:x86

4bbc1cf495586cbfec56c9ae7e37830e

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bb:59:95:69:be:a0:51:dc:38:84:4a:96:01:f7:eb:dc:3e:3d:d0:62:33:32:38:0f:81:7d:79:a0:bd:f1:e0:b6
Signer

Actual PE Digest

bb:59:95:69:be:a0:51:dc:38:84:4a:96:01:f7:eb:dc:3e:3d:d0:62:33:32:38:0f:81:7d:79:a0:bd:f1:e0:b6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\WinNtDes.pdb

Imports

kernel32

GetWindowsDirectoryW
GetModuleFileNameW
OpenEventW
CreateEventW
WaitForSingleObjectEx
SleepEx
WaitForSingleObject
QueueUserAPC
TerminateThread
GetTickCount
DisableThreadLibraryCalls
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
CreateFileW
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
OpenProcess
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
QueueUserWorkItem
Sleep
CloseHandle
GetSystemDirectoryW
GetProcessIdOfThread
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
GetProcessHeap
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
MoveFileExW
CreateDirectoryW
SetStdHandle
GetConsoleCP
OpenThread
SystemTimeToTzSpecificLocalTime
ReadConsoleW
GetConsoleMode
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
SetConsoleCtrlHandler
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
GetTimeFormatW
GetDateFormatW
GetACP
WriteConsoleW
GetFileType
GetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
ExitProcess
InterlockedFlushSList
RtlUnwind
ReleaseMutex
OpenMutexW
OpenFileMappingW
HeapDestroy
DecodePointer
WideCharToMultiByte
FormatMessageW
MultiByteToWideChar
EncodePointer
SetLastError
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
OutputDebugStringW
GetModuleFileNameA
GetFileSizeEx
WriteFile
OutputDebugStringA
CreateFileA
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
SetFilePointerEx
ReadFile
QueryDosDeviceW
GetLogicalDrives
FindFirstFileW
FindNextFileW
lstrcpynW
DeviceIoControl
GetDriveTypeA
SetFilePointer
SetEndOfFile
GetTempPathW
FindClose
GetVolumeInformationA
LocalAlloc
GetFileAttributesW
GetVersionExW
GetModuleHandleA
SetFileAttributesW
GetFileAttributesExW
FileTimeToSystemTime
DeleteFileA
DeleteFileW
LoadLibraryW
LocalFree
FreeLibrary
LoadLibraryExW
lstrlenW
GetFileSize
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
CreateMutexW
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
LoadLibraryA
GetVersionExA
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
WritePrivateProfileStringA
GetComputerNameW
CreateDirectoryA
GetPrivateProfileStringA
GetVolumeInformationW
GetDiskFreeSpaceExW
GetDriveTypeW
GetCurrentDirectoryW

user32

wsprintfW
MessageBoxW
GetProcessWindowStation
wsprintfA
CharUpperW
GetUserObjectInformationW

advapi32

RegOpenKeyExA
RegCreateKeyExW
SetEntriesInAclW
AllocateAndInitializeSid
RegQueryValueExA
SetFileSecurityW
GetTokenInformation
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExW
RegCloseKey
InitializeSecurityDescriptor
RegSetValueExW
CryptGenRandom
OpenProcessToken
AdjustTokenPrivileges
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupPrivilegeValueW
SetSecurityDescriptorDacl

ole32

CoInitializeEx

oleaut32

VariantClear
SysAllocString
SysAllocStringLen
SysStringLen
SysFreeString

shlwapi

SHSetValueW
SHSetValueA
PathFindFileNameA
StrToIntExA
PathAppendA
PathFileExistsA
wvnsprintfA
PathFileExistsW
PathAppendW
wnsprintfW
SHDeleteValueA
PathFindFileNameW
wnsprintfA
PathMatchSpecW

winntdes.exe

FePolSetConfiguration

winfscore

FesfUtil2GetFullyQualifiedPath_C
FesfUtil2ReadHeaderExclusive_C
FesfUtil2ReadHeaderUnsafe_C
FesfUtil2PurgePolicyCacheForThreadId_C
FesfUtil2PurgePolicyCacheForFile_C
FesfUtil2GetSidForThreadId_C
FesfUtil2GetExecutablePathForThreadId_C

ws2_32

inet_ntoa
shutdown
getnameinfo
ioctlsocket
sendto
recvfrom
freeaddrinfo
getaddrinfo
listen
htonl
WSAGetLastError
accept
select
setsockopt
htons
recv
connect
socket
inet_addr
WSASetLastError
__WSAFDIsSet
WSACleanup
WSACreateEvent
WSACloseEvent
WSAIoctl
bind
gethostname
closesocket
WSAStartup
ntohs
getsockopt
getsockname
getpeername
gethostbyname
WSAEventSelect
WSAEnumNetworkEvents
send

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW

crypt32

CryptMsgClose
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertDuplicateCertificateContext
CertGetNameStringW
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFindCertificateInStore

wintrust

CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext
CryptCATAdminEnumCatalogFromHash
WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle

netapi32

Netbios

rpcrt4

UuidFromStringA

iphlpapi

GetAdaptersAddresses

wldap32

ord117
ord145
ord219
ord46
ord14
ord216
ord208
ord41
ord301
ord26
ord27
ord127
ord167
ord142
ord79
ord133
ord147

shell32

SHCreateDirectoryExA
SHCreateDirectoryExW
SHGetSpecialFolderPathW

Exports

Exports

PolicyDllInit
PurgePolicyCacheFile

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 536KB - Virtual size: 536KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinNtDes.exe
.exe windows:6 windows x86 arch:x86

858c8f880ffefb36805d8ce425f61f7c

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9e:b8:bc:a4:2f:bb:bb:ab:68:1a:9a:de:17:72:b9:5b:e0:b2:f5:f9:c3:db:cb:71:09:c4:07:91:ad:b0:1c:6b
Signer

Actual PE Digest

9e:b8:bc:a4:2f:bb:bb:ab:68:1a:9a:de:17:72:b9:5b:e0:b2:f5:f9:c3:db:cb:71:09:c4:07:91:ad:b0:1c:6b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\UM_FESF\Release\WinNtDes.pdb

Imports

kernel32

LocalFree
FreeLibrary
SetConsoleCtrlHandler
DebugBreak
FlushFileBuffers
GetProcAddress
GetModuleFileNameW
FormatMessageW
GetTimeFormatW
GetDateFormatW
SetEndOfFile
GetOverlappedResult
ResetEvent
CreateThread
LoadLibraryW
CloseHandle
SetEvent
GetLastError
CreateEventW
ReleaseMutex
CreateFileW
LocalAlloc
WaitForSingleObject
CreateMutexW
WaitForMultipleObjects
DeviceIoControl
SetLastError
lstrlenW
CancelIo
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetFileType
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
GetFileSizeEx
SetFilePointerEx
GetConsoleOutputCP
GetConsoleMode
HeapSize
ReadFile
ReadConsoleW
WriteConsoleW

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW
RegSetValueExW
RegGetValueW
RegDeleteValueW
SetSecurityDescriptorDacl
RegCloseKey
AllocateAndInitializeSid
SetEntriesInAclW
RegCreateKeyExW
FreeSid
InitializeSecurityDescriptor
RegQueryValueExW

Exports

Exports

FePolSetConfiguration

Sections

.text
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinNtDs.exe
.exe windows:6 windows x86 arch:x86

3f9ed384dd89065bcf3f65c0b7757e26

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c2:bf:98:67:9b:8a:f5:44:01:44:38:51:e8:54:35:67:c1:a2:1a:50:71:60:ba:27:59:b5:9e:fd:ef:77:63:0d
Signer

Actual PE Digest

c2:bf:98:67:9b:8a:f5:44:01:44:38:51:e8:54:35:67:c1:a2:1a:50:71:60:ba:27:59:b5:9e:fd:ef:77:63:0d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\UM_FESF\Release\WinNtDs.pdb

Imports

ntdll

NtQueryEaFile
RtlNtStatusToDosError
NtSetEaFile
RtlUnwind
NtQueryInformationFile
NtCreateFile

kernel32

FlushFileBuffers
GetFileSizeEx
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
DeviceIoControl
GetCurrentThreadId
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
CreateThread
Sleep
CreateEventW
WaitForSingleObject
SetEvent
DecodePointer
GetCommandLineW
MultiByteToWideChar
ReplaceFileW
lstrcmpiW
LocalFree
FindResourceW
SizeofResource
LockResource
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
FindResourceExW
GetCurrentThread
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
SetLastError
GetLastError
RaiseException
CloseHandle
SetFileTime
SetFileAttributesW
GetFileTime
GetFileAttributesW
WriteConsoleW
DeleteFileW
CreateFileW
SetStdHandle
GetStringTypeW
GetConsoleOutputCP
GetConsoleMode
FreeEnvironmentStringsW
FindFirstFileExW
FindClose
LCMapStringW
GetFileType
GetStdHandle
GetModuleHandleExW
ExitProcess
VirtualQuery
VirtualProtect
VirtualAlloc
GetSystemInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringW
IsDebuggerPresent

user32

DispatchMessageW
MessageBoxW
CharUpperW
PostThreadMessageW
LoadStringW
TranslateMessage
GetMessageW
CharNextW

advapi32

ControlService
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
CloseServiceHandle
RegQueryValueExW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
SetNamedSecurityInfoW
GetNamedSecurityInfoW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
LookupPrivilegeValueW
RevertToSelf
MakeSelfRelativeSD
IsValidSid
InitializeSid
InitializeAcl
ImpersonateSelf
GetTokenInformation
GetSidSubAuthority
GetSidLengthRequired
GetSecurityDescriptorSacl
GetSecurityDescriptorOwner
GetSecurityDescriptorLength
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
GetLengthSid
GetAclInformation
GetAce
EqualSid
CopySid
AdjustTokenPrivileges
AddAce
OpenThreadToken
SetThreadToken

ole32

CoCreateFreeThreadedMarshaler
CoRevertToSelf
CoCreateInstance
StringFromGUID2
CoCreateGuid
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoRegisterClassObject
CoResumeClassObjects
CoImpersonateClient
CoAddRefServerProcess
CoReleaseServerProcess
CoInitializeSecurity
CoRevokeClassObject

oleaut32

SysStringLen
SysAllocString
SysAllocStringLen
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
VarBstrCat
VarUI4FromStr
VariantClear
SafeArrayGetVartype
SafeArrayCopy
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayCreate
SysAllocStringByteLen
SysStringByteLen
SysFreeString

userenv

UnloadUserProfile

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinShdlTaskEx.dll
.dll windows:5 windows x86 arch:x86

4def7ea518d92208a6b16481dae92f53

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d3:71:b5:62:da:5d:42:01:6c:c9:fb:9d:d6:07:af:5a:0c:89:69:ed:11:51:ea:82:aa:99:28:d5:52:e1:6b:0b
Signer

Actual PE Digest

d3:71:b5:62:da:5d:42:01:6c:c9:fb:9d:d6:07:af:5a:0c:89:69:ed:11:51:ea:82:aa:99:28:d5:52:e1:6b:0b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\WinShdlTaskEx.pdb

Imports

kernel32

FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
SetStdHandle
GetConsoleCP
FlushFileBuffers
DeleteCriticalSection
DecodePointer
RaiseException
GetLastError
InitializeCriticalSectionAndSpinCount
InterlockedDecrement
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
LCMapStringW
LocalFree
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
GetStartupInfoW
HeapFree
SetLastError
GetCurrentProcess
WriteFile
TerminateProcess
FindClose
CreateFileW
GetCurrentThreadId
CloseHandle
HeapAlloc
GetProcAddress
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
FreeLibrary
LoadLibraryExW
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameA
SetFilePointerEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InterlockedFlushSList
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetFileType
GetModuleHandleExW
WriteConsoleW
ExitProcess
GetConsoleMode
GetACP
GetStringTypeW
HeapSize
HeapReAlloc

shell32

SHGetSpecialFolderPathW

ole32

CoInitializeEx
CoInitializeSecurity
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantInit
SysFreeString
SysStringByteLen
SysAllocStringByteLen
SysAllocString
VariantClear

shlwapi

wnsprintfW
PathAppendW

Exports

Exports

CreateWinShdlTaskEx
DeleteWinShdlTaskEx

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinSoMgr.dll
.dll windows:5 windows x86 arch:x86

7b6af05a06bfefb7ba89dcfb68f3bc29

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:b5:88:5d:e9:17:88:a6:c5:79:52:8b:da:53:74:87:c8:bc:cc:ea:0e:fd:f1:74:12:29:d8:88:13:f5:29:a9
Signer

Actual PE Digest

05:b5:88:5d:e9:17:88:a6:c5:79:52:8b:da:53:74:87:c8:bc:cc:ea:0e:fd:f1:74:12:29:d8:88:13:f5:29:a9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\WinSoMgr.pdb

Imports

kernel32

lstrcmpiW
OpenProcess
GetSystemDirectoryW
GetWindowsDirectoryW
FindClose
FindNextFileW
CreateDirectoryW
FindFirstFileW
DeleteFileW
GetLastError
ResetEvent
SetEvent
Sleep
CreateEventW
OpenEventW
WaitForSingleObject
InitializeCriticalSection
DisableThreadLibraryCalls
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
SystemTimeToTzSpecificLocalTime
MoveFileExW
QueryPerformanceFrequency
SleepEx
SetStdHandle
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
LeaveCriticalSection
EnterCriticalSection
CloseHandle
Process32FirstW
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
SetConsoleCtrlHandler
WriteConsoleW
GetFileType
GetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
ExitProcess
InterlockedFlushSList
InterlockedPushEntrySList
RaiseException
RtlUnwind
Process32NextW
CreateToolhelp32Snapshot
FormatMessageW
WideCharToMultiByte
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
ReadFile
QueryDosDeviceW
GetLogicalDrives
CancelIo
HeapFree
WriteFile
DeviceIoControl
GetDriveTypeA
SetFilePointer
SetEndOfFile
GetTempPathW
GetVolumeInformationA
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
GetModuleHandleA
SetFileAttributesW
GetFileAttributesExW
CreateFileA
FileTimeToSystemTime
DeleteFileA
LoadLibraryW
HeapAlloc
LocalFree
GetProcessHeap
FreeLibrary
CreateFileMappingW
MapViewOfFile
LoadLibraryExW
GetFileSize
GetModuleFileNameA
GetFileSizeEx
OutputDebugStringA
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
SetFilePointerEx
GetComputerNameW
GetPrivateProfileStringA
GetDriveTypeW
CreateMutexW
OpenFileMappingW
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
GetCurrentDirectoryW

user32

GetProcessWindowStation
wsprintfW
MessageBoxW
GetUserObjectInformationW
wsprintfA

advapi32

RegOpenKeyExA
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
RegQueryValueExA
GetTokenInformation
RegQueryValueExW
CryptGenRandom
RegEnumValueW
OpenServiceW
QueryServiceConfigW
RegOpenKeyExW
RegEnumKeyExW
CloseServiceHandle
RegCloseKey
RegDeleteKeyExW
RegDeleteValueW
QueryServiceStatusEx
ControlService
DeleteService
OpenSCManagerW
LookupAccountNameW
GetUserNameW
ConvertSidToStringSidW
EnumServicesStatusExW
OpenProcessToken
ImpersonateLoggedOnUser
RevertToSelf
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
SetSecurityDescriptorDacl
SetFileSecurityW

shell32

SHGetFolderPathW
SHCreateItemFromParsingName
SHCreateDirectoryExA
SHCreateDirectoryExW
SHGetSpecialFolderPathW

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize

shlwapi

StrStrIA
wvnsprintfW
PathFindFileNameA
SHSetValueA
wvnsprintfA
wnsprintfA
PathIsPrefixW
wnsprintfW
SHGetValueW
PathFileExistsW
PathAppendW
PathAppendA
PathFileExistsA
PathFindExtensionW

ws2_32

recv
htons
WSAGetOverlappedResult
setsockopt
WSAGetLastError
send
WSARecv
shutdown
getnameinfo
ioctlsocket
WSAWaitForMultipleEvents
gethostbyname
inet_ntoa
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
getpeername
getsockname
gethostname
bind
WSAIoctl
closesocket
getsockopt
ntohs
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
connect
socket
inet_addr
WSASetLastError
WSACreateEvent
WSACloseEvent

psapi

GetModuleFileNameExW

crypt32

CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

wldap32

ord301
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145
ord147

Exports

Exports

GetUninstallInfo
GetUninstallTasks
ReleaseDeleteApplicationXml
ReleaseUninstallInfo
SendUninstallApplicationInfo
StartDeleteApplication
UninstallApplicationEx

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 506KB - Virtual size: 505KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinSoMgrEx32.dll
.dll windows:5 windows x86 arch:x86

51f1a7b6b93e95e945788223513492ed

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:3d:94:2a:fe:3c:6d:3c:ab:e1:2f:b6:45:e2:3f:d5:4a:52:90:33:38:ff:b9:b8:2f:48:97:f8:3a:db:22:03
Signer

Actual PE Digest

71:3d:94:2a:fe:3c:6d:3c:ab:e1:2f:b6:45:e2:3f:d5:4a:52:90:33:38:ff:b9:b8:2f:48:97:f8:3a:db:22:03

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\Nsec\Release\Client\WinSoMgrEx32.pdb

Imports

kernel32

FileTimeToLocalFileTime
CloseHandle
FileTimeToSystemTime
GetFileAttributesExW
GetLastError
QueueUserWorkItem
DeleteCriticalSection
TerminateThread
CreateFileW
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
ReadFile
FreeLibrary
OpenProcess
QueueUserAPC
SleepEx
GetProcAddress
GetLocalTime
LoadLibraryW
CreateDirectoryW
VerifyVersionInfoW
VerSetConditionMask
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
MoveFileExW
GetCurrentDirectoryW
GetConsoleCP
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
FreeLibraryAndExitThread
ExitThread
CreateThread
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
SetConsoleCtrlHandler
WriteConsoleW
ExitProcess
InterlockedFlushSList
InterlockedPushEntrySList
RaiseException
RtlUnwind
lstrlenW
LoadLibraryExW
FormatMessageW
WideCharToMultiByte
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetFileSize
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
QueryPerformanceFrequency
GetFileSizeEx
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
CreateFileA
ReleaseMutex
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
InterlockedIncrement
GetStdHandle
GetFileType
WriteFile
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryA
FindClose
FindFirstFileW
FindNextFileW
GetEnvironmentVariableW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetLogicalDrives
SetFileAttributesW
Sleep
GetDriveTypeW
CreateMutexW
GetSystemDirectoryW
LocalFree
OpenMutexW
MoveFileExA
DeleteFileA
OpenFileMappingW
CreateFileMappingW
GetDriveTypeA
GetVolumeInformationA
SetFileAttributesA
GetComputerNameW
GetProcessHeap
GetPrivateProfileStringA
GetModuleFileNameW
GetModuleFileNameA
AreFileApisANSI
TryEnterCriticalSection
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
GetFileAttributesW
GetVersionExW
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
GetVersionExA
DeleteFileW
HeapCompact
UnlockFile
LockFileEx
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
GetSystemDirectoryA
SetFilePointerEx
QueryDosDeviceW
lstrcpynW
DeviceIoControl
LocalAlloc
GetModuleHandleA
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
InitializeSecurityDescriptor
RegOpenKeyExW
RegCloseKey
SetFileSecurityW
ConvertSidToStringSidA
RegQueryValueExA
RegCreateKeyExW
RegSetValueExW
SetEntriesInAclW
ConvertSidToStringSidW
OpenProcessToken
RegQueryValueExW
GetTokenInformation
RegOpenKeyExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
AllocateAndInitializeSid

shlwapi

wvnsprintfA
PathFindFileNameA
PathAppendW
StrToInt64ExA
wnsprintfA
wnsprintfW
SHDeleteKeyW
PathFindFileNameW
SHSetValueA
StrStrIA
SHEnumKeyExW
SHGetValueW
PathFileExistsW
PathFindExtensionW
StrStrIW
PathFileExistsA
StrToIntExA

psapi

EnumProcesses
GetModuleFileNameExW
EnumProcessModulesEx

bcrypt

BCryptGenRandom

iphlpapi

GetAdaptersAddresses

ws2_32

WSAStartup
gethostbyname
ntohs
getsockopt
getsockname
ioctlsocket
WSAGetLastError
getaddrinfo
freeaddrinfo
getnameinfo
send
WSASetLastError
accept
bind
closesocket
connect
listen
setsockopt
socket
inet_ntoa
shutdown
WSACleanup
gethostname
htons
WSAWaitForMultipleEvents
inet_addr
WSACreateEvent
WSACloseEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
getpeername
__WSAFDIsSet
select
htonl
recvfrom
sendto
recv
WSAIoctl

crypt32

CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertFindCertificateInStore
CertOpenSystemStoreW

wldap32

ord145
ord301
ord147
ord133
ord46
ord14
ord79
ord142
ord167
ord127
ord27
ord26
ord219
ord117
ord41
ord208
ord216

netapi32

Netbios

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

user32

GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
wsprintfA
CharUpperW

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHCreateDirectoryExA

Exports

Exports

StartPiracyCheckEngine
StopPiracyCheckEngine

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 670KB - Virtual size: 669KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 94KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinSpolEx32.dll
.dll windows:5 windows x86 arch:x86

d2f19770a43dddc0dda23271f485ae1d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

17:83:f7:e5:18:bd:ea:4f:2d:5f:f9:00:9a:50:5e:db:1e:84:27:a0:6f:fa:e1:c1:2b:fb:c5:c3:16:72:e2:a9
Signer

Actual PE Digest

17:83:f7:e5:18:bd:ea:4f:2d:5f:f9:00:9a:50:5e:db:1e:84:27:a0:6f:fa:e1:c1:2b:fb:c5:c3:16:72:e2:a9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\WinSpolEx32.pdb

Imports

kernel32

DeleteCriticalSection
TlsAlloc
TlsFree
SystemTimeToTzSpecificLocalTime
DisableThreadLibraryCalls
InitializeCriticalSection
SleepEx
QueueUserAPC
TerminateThread
MulDiv
GetTickCount
TlsGetValue
SystemTimeToFileTime
GetCurrentProcessId
GetLocalTime
CreateFileA
GetComputerNameExW
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
TlsSetValue
GetFileAttributesExA
ReadFile
LoadLibraryExW
FreeLibrary
GetModuleHandleW
GetProcAddress
CreateFileMappingW
GetFileSize
UnmapViewOfFile
SetFilePointer
WriteFile
VirtualQuery
SetThreadContext
FlushInstructionCache
GetThreadContext
GetCurrentThread
SuspendThread
GetCurrentThreadId
VirtualAlloc
InterlockedCompareExchange
GetCurrentProcess
VirtualFree
VirtualProtect
VirtualQueryEx
ExitProcess
VirtualProtectEx
CloseHandle
GetLastError
OpenProcess
ResumeThread
WaitForSingleObject
GetEnvironmentVariableA
GetEnvironmentVariableW
TerminateProcess
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
CompareFileTime
QueryPerformanceFrequency
MoveFileExW
CreateDirectoryW
SetStdHandle
GetTimeZoneInformation
SetLastError
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleCP
SetConsoleCtrlHandler
ReadConsoleW
GetConsoleMode
GetACP
FreeLibraryAndExitThread
ExitThread
CreateThread
WriteConsoleW
GetModuleHandleExW
GetFileType
GetStdHandle
InterlockedFlushSList
InterlockedPushEntrySList
GetCurrentDirectoryW
RaiseException
RtlUnwind
SetFilePointerEx
GetSystemDirectoryA
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
MultiByteToWideChar
FormatMessageW
WideCharToMultiByte
GetStringTypeW
SwitchToThread
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetLogicalDrives
HeapFree
GetDriveTypeA
GetVolumeInformationA
HeapAlloc
SetFileAttributesA
GetComputerNameW
GetProcessHeap
GetPrivateProfileStringA
SetFileAttributesW
Sleep
GetDriveTypeW
GetModuleFileNameA
DeleteFileA
OpenFileMappingW
MapViewOfFile
CreateMutexW
GetSystemDirectoryW
LocalFree
OpenMutexW
ReleaseMutex
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateFileW
GetFileAttributesW
GetVersionExW
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
GetVersionExA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetSystemTime
FormatMessageA
FlushFileBuffers
lstrlenW
lstrcpynW
QueryDosDeviceW
FindFirstFileW
FindNextFileW
DeviceIoControl
FindClose
GetModuleHandleA
FileTimeToSystemTime
GetFileSizeEx

user32

MessageBoxW
wsprintfW
GetDC
GetProcessWindowStation
GetDesktopWindow
GetUserObjectInformationW
wsprintfA
CharUpperW
IsWindow
EnableWindow
EndPaint
BeginPaint
UpdateWindow
PostQuitMessage
SetWindowLongW
LoadCursorW
LoadIconW
TranslateMessage
SetLayeredWindowAttributes
RegisterClassW
DispatchMessageW
ShowWindow
UnregisterClassW
SendMessageW
CreateWindowExW
SetWindowPos
DefWindowProcW
GetMessageW
GetWindowLongW

gdi32

SetTextAlign
Escape
GetCurrentObject
SetROP2
ExtSelectClipRgn
SetMapMode
CloseFigure
ArcTo
CreateDCA
InvertRgn
RestoreDC
SetStretchBltMode
Ellipse
SetBkColor
MoveToEx
ExcludeClipRect
SetDCBrushColor
GetTextColor
RoundRect
Polygon
GetViewportExtEx
SetColorAdjustment
SetTextJustification
SelectClipRgn
SetViewportOrgEx
Rectangle
ScaleViewportExtEx
OffsetWindowOrgEx
SelectPalette
LineTo
SetBkMode
AngleArc
TextOutA
EndPath
SetMapperFlags
PolyPolygon
ExtEscape
SetPixelV
GetTextAlign
PolyTextOutW
SetPolyFillMode
StrokeAndFillPath
StrokePath
SetViewportExtEx
DeleteEnhMetaFile
SetMiterLimit
GetWindowOrgEx
MaskBlt
Polyline
OffsetViewportOrgEx
ExtFloodFill
CreateEnhMetaFileW
SelectClipPath
SetWindowExtEx
PolyDraw
PolyBezier
PolyBezierTo
OffsetClipRgn
GetClipBox
SetWindowOrgEx
SetSystemPaletteUse
CopyEnhMetaFileW
UpdateColors
StretchDIBits
PlayEnhMetaFile
PaintRgn
Chord
CloseEnhMetaFile
PlgBlt
RealizePalette
EndDoc
BeginPath
SetMetaRgn
AbortDoc
PolyPolyline
FrameRgn
StretchBlt
FloodFill
SetGraphicsMode
PatBlt
SetPixel
SetBoundsRect
CreateCompatibleDC
FillPath
GetBkMode
Arc
GetWorldTransform
StartPage
GetWindowExtEx
SelectObject
Pie
ScaleWindowExtEx
ModifyWorldTransform
ExtTextOutA
SaveDC
PolylineTo
PolyTextOutA
BitBlt
GetBkColor
SetBrushOrgEx
CancelDC
SetDCPenColor
FillRgn
ExtTextOutW
SetTextCharacterExtra
StartDocW
WidenPath
EndPage
GetViewportOrgEx
IntersectClipRect
SetWorldTransform
CreateDCW
CreateFontW
GetDeviceCaps
GetTextMetricsW
DeleteDC
TextOutW
SetTextColor
DeleteObject
GetMapMode
FlattenPath
GetStockObject
CreatePen
CreateSolidBrush
SetArcDirection

winspool.drv

StartPagePrinter
ClosePrinter
OpenPrinterW
StartDocPrinterW
EndDocPrinter

advapi32

SetFileSecurityW
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
RegCloseKey
SetSecurityDescriptorDacl
CryptAcquireContextW
GetUserNameW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
GetTokenInformation
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExA
OpenProcessToken
RegQueryValueExA
CryptGenRandom
CryptDecrypt
CryptCreateHash
ConvertSidToStringSidA

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHCreateDirectoryExA

shlwapi

wnsprintfA
PathFindFileNameW
StrStrIW
SHSetValueW
SHDeleteValueA
PathFileExistsW
wnsprintfW
PathAppendW
SHSetValueA
PathAppendA
StrStrIA
SHGetValueW
PathFileExistsA
wvnsprintfA
PathFindFileNameA
StrToIntExA
wvnsprintfW

gdiplus

GdipCreateFromHDC
GdipFree
GdipDisposeImage
GdipDeleteGraphics
GdipGetImageWidth
GdipAlloc
GdipCloneImage
GdipGetImageHeight
GdipLoadImageFromFile
GdiplusStartup
GdipDrawImageRectI
GdiplusShutdown
GdipFillEllipseI

netapi32

NetUserGetInfo
Netbios
NetApiBufferFree

iphlpapi

GetAdaptersAddresses

ws2_32

WSACloseEvent
gethostname
shutdown
getnameinfo
ioctlsocket
inet_ntoa
gethostbyname
WSAGetLastError
setsockopt
htons
recv
closesocket
WSAIoctl
bind
send
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
getpeername
getsockname
ntohs
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
WSAWaitForMultipleEvents
connect
sendto
socket
inet_addr
WSASetLastError
WSACreateEvent
getsockopt

crypt32

CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertDuplicateCertificateContext

wldap32

ord27
ord216
ord14
ord46
ord219
ord145
ord41
ord117
ord26
ord208
ord127
ord167
ord142
ord79
ord133
ord147
ord301

psapi

GetModuleFileNameExW

ole32

CoCreateGuid

Exports

Exports

MSDetoursPrinterHook
MSDetoursPrinterUnHook

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 550KB - Virtual size: 550KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
WinWebTools32.dll
.dll windows:5 windows x86 arch:x86

da6575ebb86bfbdda3df2ece63450440

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

47:51:c4:c4:32:97:b6:9a:fe:5c:7c:44:af:1c:50:c4:f9:28:01:a3:2a:1e:bc:7c:a5:98:91:94:cc:98:f3:a6
Signer

Actual PE Digest

47:51:c4:c4:32:97:b6:9a:fe:5c:7c:44:af:1c:50:c4:f9:28:01:a3:2a:1e:bc:7c:a5:98:91:94:cc:98:f3:a6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\WinWebTools32.pdb

Imports

kernel32

SystemTimeToTzSpecificLocalTime
DisableThreadLibraryCalls
GetModuleFileNameW
GetTickCount
SleepEx
GetCurrentProcessId
QueueUserAPC
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
SwitchToFiber
GlobalMemoryStatus
MoveFileExW
CreateDirectoryW
DecodePointer
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
SetConsoleCtrlHandler
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
CloseHandle
TerminateThread
SetEvent
Sleep
FindFirstFileExA
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStringTypeW
GetACP
ReadConsoleW
GetConsoleMode
WriteConsoleW
GetFileType
GetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
ExitProcess
CreateEventW
WaitForSingleObject
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
ReadFile
QueryDosDeviceW
GetLogicalDrives
FindFirstFileW
HeapFree
SetLastError
FindNextFileW
WriteFile
lstrcpynW
DeviceIoControl
GetDriveTypeA
SetFilePointer
SetEndOfFile
GetTempPathW
FindClose
GetVolumeInformationA
CreateFileW
GetFileAttributesW
GetVersionExW
GetSystemDirectoryW
UnmapViewOfFile
GetModuleHandleA
OpenProcess
SetFileAttributesW
GetLastError
GetFileAttributesExW
CreateFileA
FileTimeToSystemTime
DeleteFileA
DeleteFileW
LoadLibraryW
HeapAlloc
GetProcAddress
LocalFree
GetProcessHeap
FreeLibrary
CreateFileMappingW
MapViewOfFile
LoadLibraryExW
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameA
GetFileSizeEx
OutputDebugStringA
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
SetFilePointerEx
GetFileSize
lstrlenW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetComputerNameW
GetPrivateProfileStringA
OpenFileMappingW
CreateMutexW
OpenMutexW
GetDriveTypeW
ReleaseMutex
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
DeleteCriticalSection
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
RtlUnwind
RaiseException
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentDirectoryW

user32

GetWindow
SendMessageTimeoutW
EnumChildWindows
RegisterWindowMessageA
EnumWindows
wsprintfA
CharUpperW
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
GetClassNameW
GetWindowThreadProcessId
CallNextHookEx
GetForegroundWindow
FindWindowW
SetWindowsHookExW
UnhookWindowsHookEx
GetParent
GetWindowLongW

ole32

CoInitialize
CoUninitialize
CoInitializeEx

oleaut32

SysFreeString
VariantInit
VariantClear

shlwapi

PathFileExistsA
PathAppendA
SHDeleteValueA
wvnsprintfA
SHSetValueA
PathFindFileNameA
PathAppendW
SHSetValueW
PathFileExistsW
StrToIntExA
PathFindFileNameW
SHGetValueW
wnsprintfA
StrCmpW
StrCmpNIA
wnsprintfW
PathMatchSpecW

oleacc

WindowFromAccessibleObject
AccessibleObjectFromWindow
ObjectFromLresult

ws2_32

gethostbyname
shutdown
WSAGetLastError
setsockopt
getnameinfo
ioctlsocket
sendto
recvfrom
htons
recv
connect
socket
inet_addr
WSASetLastError
WSACreateEvent
WSACloseEvent
closesocket
WSAIoctl
bind
gethostname
freeaddrinfo
inet_ntoa
getaddrinfo
listen
htonl
accept
select
send
WSAEnumNetworkEvents
WSAEventSelect
getpeername
getsockname
getsockopt
ntohs
WSAStartup
WSACleanup
__WSAFDIsSet

psapi

GetModuleFileNameExW

crypt32

CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

wldap32

ord117
ord26
ord208
ord41
ord216
ord46
ord27
ord127
ord167
ord142
ord79
ord133
ord219
ord147
ord301
ord145
ord14

advapi32

RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExW
RegOpenKeyExA
InitializeSecurityDescriptor
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
RegCloseKey
SetFileSecurityW
ConvertSidToStringSidA
RegQueryValueExA
AllocateAndInitializeSid
SetEntriesInAclW
OpenProcessToken
GetTokenInformation

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHCreateDirectoryExA

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 481KB - Virtual size: 480KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ChromeR
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
buildin.cfg
curl.exe
.exe windows:4 windows x86 arch:x86

dbf28d34947cef1a75138f1f857b3dfe

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ac:45:67:75:d6:de:1e:b2:72:c2:33:ff:6a:4b:92:07:12:b7:78:20:6f:fd:6e:cc:05:db:69:18:cf:2e:3e:2e
Signer

Actual PE Digest

ac:45:67:75:d6:de:1e:b2:72:c2:33:ff:6a:4b:92:07:12:b7:78:20:6f:fd:6e:cc:05:db:69:18:cf:2e:3e:2e

Digest Algorithm

sha256

PE Digest Matches

true

ac:45:67:75:d6:de:1e:b2:72:c2:33:ff:6a:4b:92:07:12:b7:78:20:6f:fd:6e:cc:05:db:69:18:cf:2e:3e:2e
Signer

Actual PE Digest

ac:45:67:75:d6:de:1e:b2:72:c2:33:ff:6a:4b:92:07:12:b7:78:20:6f:fd:6e:cc:05:db:69:18:cf:2e:3e:2e

Digest Algorithm

sha256

PE Digest Matches

true

ac:45:67:75:d6:de:1e:b2:72:c2:33:ff:6a:4b:92:07:12:b7:78:20:6f:fd:6e:cc:05:db:69:18:cf:2e:3e:2e
Signer

Actual PE Digest

ac:45:67:75:d6:de:1e:b2:72:c2:33:ff:6a:4b:92:07:12:b7:78:20:6f:fd:6e:cc:05:db:69:18:cf:2e:3e:2e

Digest Algorithm

sha256

PE Digest Matches

true

ac:45:67:75:d6:de:1e:b2:72:c2:33:ff:6a:4b:92:07:12:b7:78:20:6f:fd:6e:cc:05:db:69:18:cf:2e:3e:2e
Signer

Actual PE Digest

ac:45:67:75:d6:de:1e:b2:72:c2:33:ff:6a:4b:92:07:12:b7:78:20:6f:fd:6e:cc:05:db:69:18:cf:2e:3e:2e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

CryptAcquireContextA
CryptAcquireContextW
CryptCreateHash
CryptDestroyHash
CryptGenRandom
CryptGetHashParam
CryptHashData
CryptReleaseContext
DeregisterEventSource
RegisterEventSourceW
ReportEventW

crypt32

CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateChainEngine
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertGetNameStringW
CertOpenStore
CertOpenSystemStoreW
CryptDecodeObjectEx
CryptQueryObject
CryptStringToBinaryW
PFXImportCertStore

kernel32

CloseHandle
CompareFileTime
ConvertFiberToThread
ConvertThreadToFiber
CreateFiber
CreateFileMappingA
CreateFileW
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFiber
EnterCriticalSection
FindClose
FindFirstFileW
FindNextFileW
FormatMessageW
FreeLibrary
GetACP
GetConsoleMode
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableA
GetEnvironmentVariableW
GetFileSizeEx
GetFileTime
GetFileType
GetLastError
GetModuleFileNameA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
GetStartupInfoW
GetStdHandle
GetSystemDirectoryW
GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetTimeZoneInformation
GetVersion
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExW
MultiByteToWideChar
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleA
ReadConsoleW
ReadFile
SearchPathW
SetConsoleCtrlHandler
SetConsoleMode
SetEndOfFile
SetFileTime
SetLastError
SetUnhandledExceptionFilter
Sleep
SleepEx
SwitchToFiber
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
WriteConsoleW
WriteFile

msvcrt

__lconv_init
__mb_cur_max
__p__commode
__p__fmode
__p__wcmdln
__set_app_type
__setusermatherr
__wgetmainargs
__winitenv
_access
_amsg_exit
_beginthreadex
_cexit
_errno
_chmod
_exit
_fileno
_fstati64
_get_osfhandle
_getpid
_initterm
_iob
_lock
_lseeki64
_onexit
_open
_setmode
_snwprintf
_sys_nerr
_unlock
_vsnprintf
_waccess
_wcsdup
_wfopen
_wopen
abort
atoi
bsearch
calloc
clearerr
exit
fclose
feof
ferror
fflush
fgets
fopen
fprintf
fputc
fputs
fread
free
fseek
ftell
fwrite
getc
getenv
isdigit
islower
isprint
isspace
isupper
isxdigit
localeconv
malloc
memchr
memcmp
memcpy
memmove
memset
localtime
gmtime
difftime
putchar
puts
qsort
raise
realloc
rewind
setbuf
setlocale
setvbuf
signal
strcat
strchr
strcmp
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtok
strtol
strtoul
tolower
ungetc
vfprintf
time
_strdup
_stricmp
_strnicmp
_strtoi64
wcschr
wcscmp
wcscpy
wcslen
wcsncmp
wcsncpy
wcspbrk
wcsstr
wcstombs
_wstati64
_vsnwprintf
_stat
_stati64
_fstat
_write
_unlink
_strdup
_setmode
_read
_mkdir
_isatty
_getch
_fileno
_fdopen
_close

user32

FindWindowA
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
SendMessageA

wldap32

ber_free
ldap_bind_sW
ldap_err2stringA
ldap_first_attributeW
ldap_first_entry
ldap_get_dnW
ldap_get_values_lenW
ldap_initW
ldap_memfreeW
ldap_msgfree
ldap_next_attributeW
ldap_next_entry
ldap_search_sW
ldap_set_optionW
ldap_simple_bind_sW
ldap_sslinitW
ldap_unbind_s
ldap_value_free_len

ws2_32

WSACleanup
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAIoctl
WSAResetEvent
WSASetEvent
WSASetLastError
WSAStartup
WSAWaitForMultipleEvents
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyname
gethostname
getnameinfo
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
listen
ntohl
ntohs
recv
recvfrom
select
send
sendto
setsockopt
shutdown
socket

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 18KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 49B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 103KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
data/Language.xml
data/NsLogon/NSecScreen.xml
.xml
data/NsLogon/arrow.png
.png
data/NsLogon/eyes.png
.png
data/NsLogon/guest.png
.png
data/NsLogon/windows10.jpg
.jpg
data/NsLogon/windows10_10.jpg
.jpg
data/NsLogon/windows10_15.jpg
.jpg
data/NsLogon/windows10_20.jpg
.jpg
data/NsLogon/windows10_25.jpg
.jpg
data/NsLogon/windows10_30.jpg
.jpg
data/NsLogon/windows10_5.jpg
.jpg
data/NsLogon/windows7.jpg
.jpg
data/NsLogon/windows7_10.jpg
.jpg
data/NsLogon/windows7_15.jpg
.jpg
data/NsLogon/windows7_20.jpg
.jpg
data/NsLogon/windows7_25.jpg
.jpg
data/NsLogon/windows7_30.jpg
.jpg
data/NsLogon/windows7_5.jpg
.jpg
data/actag.dat
data/av_feature.xml
data/db_bk/readme.txt
data/db_template/doc_txt_db_template.db
data/fileopermatchedrules.json
data/local_file_template.db
data/nsec_magic.json
data/piracy_engine_config.json
data/sensitive_info_template.db
data/smartsnap_template.db
data/triddefs.trd
data/wc-sig_template.db
data/workstat_template.db
drivers/nfsflt/arm/nFsFlt32.dll
.sys windows:6 windows x86 arch:x86

74d3642f3a54f01118d2a86e0da83944

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9e:5e:b7:e2:41:d5:ac:6a:db:53:91:1f:b1:38:28:35:5b:0f:af:ae:e9:03:62:a7:51:0c:65:38:c8:db:66:0c
Signer

Actual PE Digest

9e:5e:b7:e2:41:d5:ac:6a:db:53:91:1f:b1:38:28:35:5b:0f:af:ae:e9:03:62:a7:51:0c:65:38:c8:db:66:0c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\NSecsoft\NSec\Client\Kernel-Drivers\Drivers\nFsFlt\nFsFlt\bin\i386\nFsFlt32.pdb

Imports

ntoskrnl.exe

KeBugCheckEx
DbgPrint
KeTickCount
PsGetCurrentProcessId
RtlFreeUnicodeString
KeInitializeEvent
PsSetCreateProcessNotifyRoutine
memset
memcpy
ExFreePoolWithTag
RtlInitUnicodeString
RtlUpcaseUnicodeString
ExAllocatePoolWithTag
RtlCompareMemory
RtlCompareUnicodeString
RtlUnwind

hal

ExReleaseFastMutex
ExAcquireFastMutex

fltmgr.sys

FltGetFileNameInformation
FltParseFileNameInformation
FltReleaseFileNameInformation
FltRegisterFilter
FltStartFiltering
FltBuildDefaultSecurityDescriptor
FltCreateCommunicationPort
FltCloseCommunicationPort
FltUnregisterFilter
FltCloseClientPort

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 128B - Virtual size: 104B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 384B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/nfsflt/arm/nFsFlt32.inf
drivers/nfsflt/arm/nFsFlt64.dll
.sys windows:6 windows x64 arch:x64

8ed0bb63ab1da8c7e8f18c3afa70f64d

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

aa:43:e9:ff:ae:c9:78:76:0a:fa:e4:89:9c:4e:80:9c:8f:fd:98:4c:9b:cc:7f:b3:58:74:c2:d6:fa:ec:45:34
Signer

Actual PE Digest

aa:43:e9:ff:ae:c9:78:76:0a:fa:e4:89:9c:4e:80:9c:8f:fd:98:4c:9b:cc:7f:b3:58:74:c2:d6:fa:ec:45:34

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\NSecsoft\NSec\Client\Kernel-Drivers\Drivers\nFsFlt\nFsFlt\bin\amd64\nFsFlt64.pdb

Imports

ntoskrnl.exe

PsGetCurrentProcessId
RtlFreeUnicodeString
KeInitializeEvent
ExAcquireFastMutex
ExReleaseFastMutex
DbgPrint
RtlCompareMemory
RtlCompareUnicodeString
PsSetCreateProcessNotifyRoutine
RtlInitUnicodeString
RtlUpcaseUnicodeString
ExFreePoolWithTag
KeBugCheckEx
ExAllocatePoolWithTag
__C_specific_handler

fltmgr.sys

FltReleaseFileNameInformation
FltGetFileNameInformation
FltStartFiltering
FltRegisterFilter
FltBuildDefaultSecurityDescriptor
FltCloseCommunicationPort
FltUnregisterFilter
FltCreateCommunicationPort
FltCloseClientPort
FltParseFileNameInformation

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 111B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/nfsflt/arm/nFsFlt64.inf
drivers/nfsflt/nFsFlt32.inf
drivers/nfsflt/nFsFlt32.sys
.sys windows:6 windows x86 arch:x86

74d3642f3a54f01118d2a86e0da83944

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:61:c8:8b:12:9c:2a:7f:1d:87:00:00:00:00:00:61
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/04/2023, 19:16

Not After

03/04/2024, 19:16

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5b:c6:29:22:21:ff:06:30:6e:30:62:1d:5c:6f:de:86:e7:81:48:91:e7:91:3f:a9:69:0f:25:4e:be:33:ca:b2
Signer

Actual PE Digest

5b:c6:29:22:21:ff:06:30:6e:30:62:1d:5c:6f:de:86:e7:81:48:91:e7:91:3f:a9:69:0f:25:4e:be:33:ca:b2

Digest Algorithm

sha256

PE Digest Matches

true

5b:c6:29:22:21:ff:06:30:6e:30:62:1d:5c:6f:de:86:e7:81:48:91:e7:91:3f:a9:69:0f:25:4e:be:33:ca:b2
Signer

Actual PE Digest

5b:c6:29:22:21:ff:06:30:6e:30:62:1d:5c:6f:de:86:e7:81:48:91:e7:91:3f:a9:69:0f:25:4e:be:33:ca:b2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\NSecsoft\NSec\Client\Kernel-Drivers\Drivers\nFsFlt\nFsFlt\bin\i386\nFsFlt32.pdb

Imports

ntoskrnl.exe

KeBugCheckEx
DbgPrint
KeTickCount
PsGetCurrentProcessId
RtlFreeUnicodeString
KeInitializeEvent
PsSetCreateProcessNotifyRoutine
memset
memcpy
ExFreePoolWithTag
RtlInitUnicodeString
RtlUpcaseUnicodeString
ExAllocatePoolWithTag
RtlCompareMemory
RtlCompareUnicodeString
RtlUnwind

hal

ExReleaseFastMutex
ExAcquireFastMutex

fltmgr.sys

FltGetFileNameInformation
FltParseFileNameInformation
FltReleaseFileNameInformation
FltRegisterFilter
FltStartFiltering
FltBuildDefaultSecurityDescriptor
FltCreateCommunicationPort
FltCloseCommunicationPort
FltUnregisterFilter
FltCloseClientPort

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 640B - Virtual size: 580B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 128B - Virtual size: 104B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 384B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/nfsflt/nFsFlt64.inf
drivers/nfsflt/nFsFlt64.sys
.sys windows:6 windows x64 arch:x64

8ed0bb63ab1da8c7e8f18c3afa70f64d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:61:c8:8b:12:9c:2a:7f:1d:87:00:00:00:00:00:61
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/04/2023, 19:16

Not After

03/04/2024, 19:16

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:82:e6:19:ff:8a:1a:aa:ce:64:ea:cd:78:64:89:d9:1b:e6:54:5b:21:3f:38:ef:12:17:8d:e8:21:2f:98:47
Signer

Actual PE Digest

52:82:e6:19:ff:8a:1a:aa:ce:64:ea:cd:78:64:89:d9:1b:e6:54:5b:21:3f:38:ef:12:17:8d:e8:21:2f:98:47

Digest Algorithm

sha256

PE Digest Matches

true

52:82:e6:19:ff:8a:1a:aa:ce:64:ea:cd:78:64:89:d9:1b:e6:54:5b:21:3f:38:ef:12:17:8d:e8:21:2f:98:47
Signer

Actual PE Digest

52:82:e6:19:ff:8a:1a:aa:ce:64:ea:cd:78:64:89:d9:1b:e6:54:5b:21:3f:38:ef:12:17:8d:e8:21:2f:98:47

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\NSecsoft\NSec\Client\Kernel-Drivers\Drivers\nFsFlt\nFsFlt\bin\amd64\nFsFlt64.pdb

Imports

ntoskrnl.exe

PsGetCurrentProcessId
RtlFreeUnicodeString
KeInitializeEvent
ExAcquireFastMutex
ExReleaseFastMutex
DbgPrint
RtlCompareMemory
RtlCompareUnicodeString
PsSetCreateProcessNotifyRoutine
RtlInitUnicodeString
RtlUpcaseUnicodeString
ExFreePoolWithTag
KeBugCheckEx
ExAllocatePoolWithTag
__C_specific_handler

fltmgr.sys

FltReleaseFileNameInformation
FltGetFileNameInformation
FltStartFiltering
FltRegisterFilter
FltBuildDefaultSecurityDescriptor
FltCloseCommunicationPort
FltUnregisterFilter
FltCreateCommunicationPort
FltCloseClientPort
FltParseFileNameInformation

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 860B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 512B - Virtual size: 111B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/nfsflt/nfsflt32.cat
drivers/nfsflt/nfsflt64.cat
drivers/nnfp/nnfp_wfp_x64.dll
.sys windows:10 windows x64 arch:x64

6023ebd9c177bdac784dd337ac32effc

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ad:04:dd:48:af:2a:98:57:7d:ee:c4:d8:ea:af:9e:ec:6c:da:0f:6b:59:c9:b9:a3:37:0b:93:cb:6c:96:d5:18
Signer

Actual PE Digest

ad:04:dd:48:af:2a:98:57:7d:ee:c4:d8:ea:af:9e:ec:6c:da:0f:6b:59:c9:b9:a3:37:0b:93:cb:6c:96:d5:18

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\Client\Fiddler\Windows\fiddler-src\driver_wfp\msvc\Win8Release\x64\netfilter2.pdb

Imports

fwpkclnt.sys

FwpsFreeNetBufferList0

ndis.sys

NdisFreeGenericObject
NdisFreeNetBufferListPool
NdisRetreatNetBufferDataStart
NdisAdvanceNetBufferDataStart
NdisGetDataBuffer
NdisAllocateGenericObject
NdisWaitEvent
NdisInitializeEvent
NdisAllocateNetBufferListPool

ntoskrnl.exe

RtlCompareMemory
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExAllocatePoolWithTag
ExUuidCreate
swprintf_s
__C_specific_handler
RtlInitUnicodeString
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
ExFreePoolWithTag
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwQueryValueKey
PsGetCurrentProcessId
ZwSetInformationThread
RtlLengthSid
RtlCreateAcl
RtlAddAccessAllowedAce
PsLookupProcessByProcessId
ObOpenObjectByPointer
ZwSetSecurityObject
SeExports
RtlGetVersion
RtlValidSid
_stricmp
ZwQuerySystemInformation
KeBugCheckEx

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 388B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/nnfp/nnfp_wfp_x64.sys
.sys windows:10 windows x64 arch:x64

6023ebd9c177bdac784dd337ac32effc

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:68:64:82:c2:f9:11:1a:c8:76:00:00:00:00:00:68
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/01/2024, 20:09

Not After

10/01/2025, 20:09

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:93:c8:10:7b:cb:6b:27:48:14:a7:b3:44:7c:af:40:11:07:52:d3:1d:14:d4:5b:d1:a1:2e:ef:f8:4e:5e:15
Signer

Actual PE Digest

77:93:c8:10:7b:cb:6b:27:48:14:a7:b3:44:7c:af:40:11:07:52:d3:1d:14:d4:5b:d1:a1:2e:ef:f8:4e:5e:15

Digest Algorithm

sha256

PE Digest Matches

true

77:93:c8:10:7b:cb:6b:27:48:14:a7:b3:44:7c:af:40:11:07:52:d3:1d:14:d4:5b:d1:a1:2e:ef:f8:4e:5e:15
Signer

Actual PE Digest

77:93:c8:10:7b:cb:6b:27:48:14:a7:b3:44:7c:af:40:11:07:52:d3:1d:14:d4:5b:d1:a1:2e:ef:f8:4e:5e:15

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\Client\Fiddler\Windows\fiddler-src\driver_wfp\msvc\Win8Release\x64\netfilter2.pdb

Imports

fwpkclnt.sys

FwpsFreeNetBufferList0

ndis.sys

NdisFreeGenericObject
NdisFreeNetBufferListPool
NdisRetreatNetBufferDataStart
NdisAdvanceNetBufferDataStart
NdisGetDataBuffer
NdisAllocateGenericObject
NdisWaitEvent
NdisInitializeEvent
NdisAllocateNetBufferListPool

ntoskrnl.exe

RtlCompareMemory
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
ExAllocatePoolWithTag
ExUuidCreate
swprintf_s
__C_specific_handler
RtlInitUnicodeString
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
ExFreePoolWithTag
ExQueryDepthSList
ExpInterlockedPopEntrySList
ExpInterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
PsCreateSystemThread
PsTerminateSystemThread
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwQueryValueKey
PsGetCurrentProcessId
ZwSetInformationThread
RtlLengthSid
RtlCreateAcl
RtlAddAccessAllowedAce
PsLookupProcessByProcessId
ObOpenObjectByPointer
ZwSetSecurityObject
SeExports
RtlGetVersion
RtlValidSid
_stricmp
ZwQuerySystemInformation
KeBugCheckEx

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 388B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/nnfp/nnfp_wfp_x86.sys
.sys windows:10 windows x86 arch:x86

060ff26f107f0097b0b776ebe74f323a

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:68:64:82:c2:f9:11:1a:c8:76:00:00:00:00:00:68
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/01/2024, 20:09

Not After

10/01/2025, 20:09

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

aa:76:dd:e8:19:97:e0:be:45:91:c7:6f:27:43:fe:e6:64:25:56:59:6b:5c:e9:ee:c8:95:ff:f1:4d:79:38:4c
Signer

Actual PE Digest

aa:76:dd:e8:19:97:e0:be:45:91:c7:6f:27:43:fe:e6:64:25:56:59:6b:5c:e9:ee:c8:95:ff:f1:4d:79:38:4c

Digest Algorithm

sha256

PE Digest Matches

true

aa:76:dd:e8:19:97:e0:be:45:91:c7:6f:27:43:fe:e6:64:25:56:59:6b:5c:e9:ee:c8:95:ff:f1:4d:79:38:4c
Signer

Actual PE Digest

aa:76:dd:e8:19:97:e0:be:45:91:c7:6f:27:43:fe:e6:64:25:56:59:6b:5c:e9:ee:c8:95:ff:f1:4d:79:38:4c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Client\Fiddler\Windows\fiddler-src\driver_wfp\msvc\Win8Release\Win32\netfilter2.pdb

Imports

fwpkclnt.sys

FwpsFreeNetBufferList0

ndis.sys

NdisGetDataBuffer
NdisAllocateGenericObject
NdisFreeGenericObject
NdisAdvanceNetBufferDataStart
NdisWaitEvent
NdisAllocateNetBufferListPool
NdisFreeNetBufferListPool
NdisRetreatNetBufferDataStart
NdisInitializeEvent

ntoskrnl.exe

memcpy
memset
RtlInitUnicodeString
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
ExFreePoolWithTag
InterlockedPopEntrySList
InterlockedPushEntrySList
ExInitializeNPagedLookasideList
ExDeleteNPagedLookasideList
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmAllocatePagesForMdl
MmFreePagesFromMdl
PsCreateSystemThread
ExUuidCreate
IoAllocateMdl
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoFreeMdl
IoReleaseCancelSpinLock
ObReferenceObjectByHandle
ObfDereferenceObject
ZwClose
ZwOpenKey
ZwQueryValueKey
PsGetCurrentProcessId
ZwSetInformationThread
RtlLengthSid
RtlCreateAcl
RtlAddAccessAllowedAce
PsLookupProcessByProcessId
ObOpenObjectByPointer
ZwSetSecurityObject
SeExports
RtlGetVersion
KeQuerySystemTime
_allmul
_aullrem
RtlValidSid
_stricmp
ZwQuerySystemInformation
swprintf_s
RtlUnwind
KeBugCheckEx
ExAllocatePoolWithTag
RtlCompareMemory
PsTerminateSystemThread

hal

KeGetCurrentIrql
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/nsdiskcrypt/nsdiskcrypt-x64.sys
.sys windows:6 windows x64 arch:x64

ff4cf8c8cdeff94c0fd35db3352495b6

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:73:52:94:cc:d4:a2:bc:58:49:28:45:7f:e7:2c:62
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/03/2020, 00:00

Not After

22/03/2021, 12:00

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,POSTALCODE=250101,STREET=高新区新泺大街2008号银荷大厦C座606,L=Jinan,ST=Shandong,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13054a696e616e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:97:4d:45:a3:88:61:c1:5e:d3:f0:31:a1:70:4c:65
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

14/10/2019, 00:00

Not After

12/12/2020, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:8c:b8:c2:d7:32:8a:10:66:c2:27:4a:47:1b:0e:b1:70:1f:71:9e:58:5c:02:92:0a:34:35:32:6e:c8:1a:2b
Signer

Actual PE Digest

70:8c:b8:c2:d7:32:8a:10:66:c2:27:4a:47:1b:0e:b1:70:1f:71:9e:58:5c:02:92:0a:34:35:32:6e:c8:1a:2b

Digest Algorithm

sha256

PE Digest Matches

true

14:5c:43:15:52:f9:52:30:42:e6:12:e8:c2:6b:d2:eb:99:f9:4c:7e
Signer

Actual PE Digest

14:5c:43:15:52:f9:52:30:42:e6:12:e8:c2:6b:d2:eb:99:f9:4c:7e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\nsecsoft\nsec\client\client-diskcrypt\veracrypt_1.24u6\src\driver\obj_driver_release\amd64\veracrypt.pdb

Imports

ntoskrnl.exe

ExFreePoolWithTag
KeInitializeMutex
PsSetLoadImageNotifyRoutine
IoAttachDeviceToDeviceStackSafe
IoDeleteDevice
KeSetEvent
IoFreeWorkItem
KeInitializeEvent
IoReleaseRemoveLockEx
KeReleaseSpinLock
MmFreeContiguousMemory
IoDetachDevice
MmUnmapIoSpace
MmBuildMdlForNonPagedPool
IoFreeMdl
KeReleaseMutex
PsTerminateSystemThread
IoAllocateWorkItem
MmMapIoSpace
PoStartNextPowerIrp
_vsnprintf
IoReleaseRemoveLockAndWaitEx
KeWaitForSingleObject
KeBugCheckEx
IoGetAttachedDeviceReference
PoCallDriver
ObfDereferenceObject
IoInitializeRemoveLockEx
IoCreateDevice
IoQueueWorkItem
IoIsSystemThread
IoAllocateMdl
MmAllocateContiguousMemory
IofCallDriver
KeAcquireSpinLockRaiseToDpc
MmMapLockedPagesSpecifyCache
KeClearEvent
ZwReadFile
KeSetPriorityThread
ExInterlockedInsertTailList
SeImpersonateClientEx
ExInterlockedRemoveHeadList
ZwWriteFile
SeTokenIsAdmin
KeQueryActiveProcessors
IoAcquireRemoveLockEx
IoDeleteSymbolicLink
IoRegisterShutdownNotification
IoBuildSynchronousFsdRequest
ZwQuerySymbolicLinkObject
SeLockSubjectContext
IoGetRelatedDeviceObject
RtlInitUnicodeString
RtlEqualSid
RtlCopySid
MmGetSystemRoutineAddress
ZwSetValueKey
ZwSetVolumeInformationFile
ZwOpenSymbolicLinkObject
KeSetTimerEx
SeReleaseSubjectContext
SeCreateClientSecurity
ZwCreateFile
PsCreateSystemThread
IoGetDeviceObjectPointer
ZwQueryValueKey
SeCaptureSubjectContext
ZwClose
IofCompleteRequest
SeQueryInformationToken
KeInitializeSemaphore
ObReferenceObjectByHandle
PsGetVersion
KeReleaseSemaphore
IoGetDeviceInterfaces
SeUnlockSubjectContext
ZwDeviceIoControlFile
ObfReferenceObject
IoCreateSymbolicLink
IoEnumerateDeviceObjectList
KeInitializeTimerEx
RtlLengthSid
SeTokenType
ZwOpenKey
ZwSetInformationFile
IoFileObjectType
_vsnwprintf
ZwQueryInformationFile
IoBuildDeviceIoControlRequest
ExAllocatePoolWithTag
_wcsicmp
ExReleaseFastMutex
ExAcquireFastMutex
_stricmp
__C_specific_handler
__chkstk

hal

KeQueryPerformanceCounter

Sections

.text
Size: 400KB - Virtual size: 400KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 353KB - Virtual size: 353KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/nsdiskcrypt/nsdiskcrypt-x86.sys
.sys windows:6 windows x86 arch:x86

18812d662edfa7dd24a77f6265f09d9f

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:73:52:94:cc:d4:a2:bc:58:49:28:45:7f:e7:2c:62
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/03/2020, 00:00

Not After

22/03/2021, 12:00

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,POSTALCODE=250101,STREET=高新区新泺大街2008号银荷大厦C座606,L=Jinan,ST=Shandong,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13054a696e616e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:97:4d:45:a3:88:61:c1:5e:d3:f0:31:a1:70:4c:65
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

14/10/2019, 00:00

Not After

12/12/2020, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bb:4e:05:a6:52:ba:81:c3:75:b3:6e:17:15:e9:74:cc:16:b3:c8:23:7c:1e:22:99:81:2c:6e:67:4f:03:e3:98
Signer

Actual PE Digest

bb:4e:05:a6:52:ba:81:c3:75:b3:6e:17:15:e9:74:cc:16:b3:c8:23:7c:1e:22:99:81:2c:6e:67:4f:03:e3:98

Digest Algorithm

sha256

PE Digest Matches

true

ce:a6:9e:48:25:d9:b4:3c:26:19:8b:0e:25:f1:ab:8c:e5:6f:60:f3
Signer

Actual PE Digest

ce:a6:9e:48:25:d9:b4:3c:26:19:8b:0e:25:f1:ab:8c:e5:6f:60:f3

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\nsecsoft\nsec\client\client-diskcrypt\veracrypt_1.24u6\src\driver\obj_driver_release\i386\veracrypt.pdb

Imports

ntoskrnl.exe

IoDeleteDevice
IoDetachDevice
IoAttachDeviceToDeviceStackSafe
ObfDereferenceObject
IoCreateDevice
IoGetAttachedDeviceReference
memset
KeRestoreFloatingPointState
KeSaveFloatingPointState
ExFreePoolWithTag
IofCallDriver
IoReleaseRemoveLockEx
PoCallDriver
IoAcquireRemoveLockEx
PoStartNextPowerIrp
IoIsSystemThread
MmFreeContiguousMemory
IoFreeMdl
PsSetLoadImageNotifyRoutine
MmBuildMdlForNonPagedPool
IoAllocateMdl
MmAllocateContiguousMemory
PsTerminateSystemThread
_alldiv
KeReleaseMutex
KeWaitForSingleObject
KeSetEvent
IoFreeWorkItem
IoQueueWorkItem
KeInitializeEvent
IoAllocateWorkItem
IoReleaseRemoveLockAndWaitEx
MmMapLockedPagesSpecifyCache
ExfInterlockedRemoveHeadList
KeSetPriorityThread
ZwReadFile
ExfInterlockedInsertTailList
ZwWriteFile
SeImpersonateClientEx
KeClearEvent
_allmul
RtlInitUnicodeString
KeQueryInterruptTime
KeQuerySystemTime
IoGetDeviceInterfaces
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
IoInitializeRemoveLockEx
KeReleaseSemaphore
KeSetTimerEx
KeInitializeTimerEx
SeTokenType
MmGetSystemRoutineAddress
IoDeleteSymbolicLink
ObfReferenceObject
IoBuildSynchronousFsdRequest
IoBuildDeviceIoControlRequest
IoGetRelatedDeviceObject
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwCreateFile
IofCompleteRequest
KeQueryActiveProcessors
ZwQueryValueKey
ZwOpenKey
ZwSetValueKey
SeReleaseSubjectContext
SeUnlockSubjectContext
RtlEqualSid
SeQueryInformationToken
SeTokenIsAdmin
SeLockSubjectContext
SeCaptureSubjectContext
IoRegisterShutdownNotification
IoCreateSymbolicLink
IoGetDeviceObjectPointer
ZwSetVolumeInformationFile
KeInitializeSemaphore
ZwDeviceIoControlFile
SeCreateClientSecurity
RtlCopySid
RtlLengthSid
IoEnumerateDeviceObjectList
PsGetVersion
_vsnwprintf
ZwSetInformationFile
ZwQueryInformationFile
IoFileObjectType
KeTickCount
memcpy
KeInitializeMutex
MmMapIoSpace
MmUnmapIoSpace
ExAllocatePoolWithTag
KeBugCheckEx
_vsnprintf
_wcsicmp
_aullshr
_stricmp
_allshl
RtlUnwind
ObOpenObjectByPointer
KeGetCurrentThread

hal

ExAcquireFastMutex
KeQueryPerformanceCounter
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
ExReleaseFastMutex

Exports

Exports

_aes_decrypt@12
_aes_encrypt@12
_aes_hw_cpu_decrypt@8
_aes_hw_cpu_decrypt_32_blocks@8
_aes_hw_cpu_enable_sse@0
_aes_hw_cpu_encrypt@8
_aes_hw_cpu_encrypt_32_blocks@8

Sections

.text
Size: 328KB - Virtual size: 328KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 346KB - Virtual size: 346KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 384B - Virtual size: 289B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/nsdiskcrypt/win10/nsdiskcrypt-x64.sys
.sys windows:6 windows x64 arch:x64

ff4cf8c8cdeff94c0fd35db3352495b6

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:5b:27:84:03:2c:07:b5:e6:3d:bb:a7:be:59:71:0d
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/04/2020, 00:00

Not After

22/03/2021, 12:00

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,POSTALCODE=250101,STREET=高新区新泺大街2008号银荷大厦C座606,L=Jinan,ST=Shandong,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13054a696e616e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:98:13:94:6f:a0:74:32:60:ca:00:00:00:00:00:98
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/03/2020, 17:48

Not After

05/03/2021, 17:48

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:8c:b8:c2:d7:32:8a:10:66:c2:27:4a:47:1b:0e:b1:70:1f:71:9e:58:5c:02:92:0a:34:35:32:6e:c8:1a:2b
Signer

Actual PE Digest

70:8c:b8:c2:d7:32:8a:10:66:c2:27:4a:47:1b:0e:b1:70:1f:71:9e:58:5c:02:92:0a:34:35:32:6e:c8:1a:2b

Digest Algorithm

sha256

PE Digest Matches

true

70:8c:b8:c2:d7:32:8a:10:66:c2:27:4a:47:1b:0e:b1:70:1f:71:9e:58:5c:02:92:0a:34:35:32:6e:c8:1a:2b
Signer

Actual PE Digest

70:8c:b8:c2:d7:32:8a:10:66:c2:27:4a:47:1b:0e:b1:70:1f:71:9e:58:5c:02:92:0a:34:35:32:6e:c8:1a:2b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

d:\nsecsoft\nsec\client\client-diskcrypt\veracrypt_1.24u6\src\driver\obj_driver_release\amd64\veracrypt.pdb

Imports

ntoskrnl.exe

ExFreePoolWithTag
KeInitializeMutex
PsSetLoadImageNotifyRoutine
IoAttachDeviceToDeviceStackSafe
IoDeleteDevice
KeSetEvent
IoFreeWorkItem
KeInitializeEvent
IoReleaseRemoveLockEx
KeReleaseSpinLock
MmFreeContiguousMemory
IoDetachDevice
MmUnmapIoSpace
MmBuildMdlForNonPagedPool
IoFreeMdl
KeReleaseMutex
PsTerminateSystemThread
IoAllocateWorkItem
MmMapIoSpace
PoStartNextPowerIrp
_vsnprintf
IoReleaseRemoveLockAndWaitEx
KeWaitForSingleObject
KeBugCheckEx
IoGetAttachedDeviceReference
PoCallDriver
ObfDereferenceObject
IoInitializeRemoveLockEx
IoCreateDevice
IoQueueWorkItem
IoIsSystemThread
IoAllocateMdl
MmAllocateContiguousMemory
IofCallDriver
KeAcquireSpinLockRaiseToDpc
MmMapLockedPagesSpecifyCache
KeClearEvent
ZwReadFile
KeSetPriorityThread
ExInterlockedInsertTailList
SeImpersonateClientEx
ExInterlockedRemoveHeadList
ZwWriteFile
SeTokenIsAdmin
KeQueryActiveProcessors
IoAcquireRemoveLockEx
IoDeleteSymbolicLink
IoRegisterShutdownNotification
IoBuildSynchronousFsdRequest
ZwQuerySymbolicLinkObject
SeLockSubjectContext
IoGetRelatedDeviceObject
RtlInitUnicodeString
RtlEqualSid
RtlCopySid
MmGetSystemRoutineAddress
ZwSetValueKey
ZwSetVolumeInformationFile
ZwOpenSymbolicLinkObject
KeSetTimerEx
SeReleaseSubjectContext
SeCreateClientSecurity
ZwCreateFile
PsCreateSystemThread
IoGetDeviceObjectPointer
ZwQueryValueKey
SeCaptureSubjectContext
ZwClose
IofCompleteRequest
SeQueryInformationToken
KeInitializeSemaphore
ObReferenceObjectByHandle
PsGetVersion
KeReleaseSemaphore
IoGetDeviceInterfaces
SeUnlockSubjectContext
ZwDeviceIoControlFile
ObfReferenceObject
IoCreateSymbolicLink
IoEnumerateDeviceObjectList
KeInitializeTimerEx
RtlLengthSid
SeTokenType
ZwOpenKey
ZwSetInformationFile
IoFileObjectType
_vsnwprintf
ZwQueryInformationFile
IoBuildDeviceIoControlRequest
ExAllocatePoolWithTag
_wcsicmp
ExReleaseFastMutex
ExAcquireFastMutex
_stricmp
__C_specific_handler
__chkstk

hal

KeQueryPerformanceCounter

Sections

.text
Size: 400KB - Virtual size: 400KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 353KB - Virtual size: 353KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/nsdiskcrypt/win10/nsdiskcrypt-x86.sys
.sys windows:6 windows x86 arch:x86

18812d662edfa7dd24a77f6265f09d9f

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:5b:27:84:03:2c:07:b5:e6:3d:bb:a7:be:59:71:0d
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/04/2020, 00:00

Not After

22/03/2021, 12:00

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,POSTALCODE=250101,STREET=高新区新泺大街2008号银荷大厦C座606,L=Jinan,ST=Shandong,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13054a696e616e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:98:13:94:6f:a0:74:32:60:ca:00:00:00:00:00:98
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/03/2020, 17:48

Not After

05/03/2021, 17:48

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bb:4e:05:a6:52:ba:81:c3:75:b3:6e:17:15:e9:74:cc:16:b3:c8:23:7c:1e:22:99:81:2c:6e:67:4f:03:e3:98
Signer

Actual PE Digest

bb:4e:05:a6:52:ba:81:c3:75:b3:6e:17:15:e9:74:cc:16:b3:c8:23:7c:1e:22:99:81:2c:6e:67:4f:03:e3:98

Digest Algorithm

sha256

PE Digest Matches

true

bb:4e:05:a6:52:ba:81:c3:75:b3:6e:17:15:e9:74:cc:16:b3:c8:23:7c:1e:22:99:81:2c:6e:67:4f:03:e3:98
Signer

Actual PE Digest

bb:4e:05:a6:52:ba:81:c3:75:b3:6e:17:15:e9:74:cc:16:b3:c8:23:7c:1e:22:99:81:2c:6e:67:4f:03:e3:98

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\nsecsoft\nsec\client\client-diskcrypt\veracrypt_1.24u6\src\driver\obj_driver_release\i386\veracrypt.pdb

Imports

ntoskrnl.exe

IoDeleteDevice
IoDetachDevice
IoAttachDeviceToDeviceStackSafe
ObfDereferenceObject
IoCreateDevice
IoGetAttachedDeviceReference
memset
KeRestoreFloatingPointState
KeSaveFloatingPointState
ExFreePoolWithTag
IofCallDriver
IoReleaseRemoveLockEx
PoCallDriver
IoAcquireRemoveLockEx
PoStartNextPowerIrp
IoIsSystemThread
MmFreeContiguousMemory
IoFreeMdl
PsSetLoadImageNotifyRoutine
MmBuildMdlForNonPagedPool
IoAllocateMdl
MmAllocateContiguousMemory
PsTerminateSystemThread
_alldiv
KeReleaseMutex
KeWaitForSingleObject
KeSetEvent
IoFreeWorkItem
IoQueueWorkItem
KeInitializeEvent
IoAllocateWorkItem
IoReleaseRemoveLockAndWaitEx
MmMapLockedPagesSpecifyCache
ExfInterlockedRemoveHeadList
KeSetPriorityThread
ZwReadFile
ExfInterlockedInsertTailList
ZwWriteFile
SeImpersonateClientEx
KeClearEvent
_allmul
RtlInitUnicodeString
KeQueryInterruptTime
KeQuerySystemTime
IoGetDeviceInterfaces
ZwClose
ObReferenceObjectByHandle
PsCreateSystemThread
IoInitializeRemoveLockEx
KeReleaseSemaphore
KeSetTimerEx
KeInitializeTimerEx
SeTokenType
MmGetSystemRoutineAddress
IoDeleteSymbolicLink
ObfReferenceObject
IoBuildSynchronousFsdRequest
IoBuildDeviceIoControlRequest
IoGetRelatedDeviceObject
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
ZwCreateFile
IofCompleteRequest
KeQueryActiveProcessors
ZwQueryValueKey
ZwOpenKey
ZwSetValueKey
SeReleaseSubjectContext
SeUnlockSubjectContext
RtlEqualSid
SeQueryInformationToken
SeTokenIsAdmin
SeLockSubjectContext
SeCaptureSubjectContext
IoRegisterShutdownNotification
IoCreateSymbolicLink
IoGetDeviceObjectPointer
ZwSetVolumeInformationFile
KeInitializeSemaphore
ZwDeviceIoControlFile
SeCreateClientSecurity
RtlCopySid
RtlLengthSid
IoEnumerateDeviceObjectList
PsGetVersion
_vsnwprintf
ZwSetInformationFile
ZwQueryInformationFile
IoFileObjectType
KeTickCount
memcpy
KeInitializeMutex
MmMapIoSpace
MmUnmapIoSpace
ExAllocatePoolWithTag
KeBugCheckEx
_vsnprintf
_wcsicmp
_aullshr
_stricmp
_allshl
RtlUnwind
ObOpenObjectByPointer
KeGetCurrentThread

hal

ExAcquireFastMutex
KeQueryPerformanceCounter
KeGetCurrentIrql
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
ExReleaseFastMutex

Exports

Exports

_aes_decrypt@12
_aes_encrypt@12
_aes_hw_cpu_decrypt@8
_aes_hw_cpu_decrypt_32_blocks@8
_aes_hw_cpu_enable_sse@0
_aes_hw_cpu_encrypt@8
_aes_hw_cpu_encrypt_32_blocks@8

Sections

.text
Size: 328KB - Virtual size: 328KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 346KB - Virtual size: 346KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 384B - Virtual size: 289B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 896B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/nskrnl/NSecKrnl32.sys
.sys windows:10 windows x86 arch:x86

43d6635c25768f0c25b05a011b1b35ba

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:73:52:94:cc:d4:a2:bc:58:49:28:45:7f:e7:2c:62
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/03/2020, 00:00

Not After

22/03/2021, 12:00

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,POSTALCODE=250101,STREET=高新区新泺大街2008号银荷大厦C座606,L=Jinan,ST=Shandong,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13054a696e616e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:97:4d:45:a3:88:61:c1:5e:d3:f0:31:a1:70:4c:65
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

14/10/2019, 00:00

Not After

12/12/2020, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ee:28:49:86:34:86:ba:08:e2:02:2b:8f:4c:a9:e7:ca:87:22:bf:31:17:09:3b:c5:fd:a9:c6:ce:b2:bc:dc:23
Signer

Actual PE Digest

ee:28:49:86:34:86:ba:08:e2:02:2b:8f:4c:a9:e7:ca:87:22:bf:31:17:09:3b:c5:fd:a9:c6:ce:b2:bc:dc:23

Digest Algorithm

sha256

PE Digest Matches

true

6d:6d:7d:b7:1c:6c:a2:a2:60:44:91:49:03:6d:5b:4c:94:22:08:a5
Signer

Actual PE Digest

6d:6d:7d:b7:1c:6c:a2:a2:60:44:91:49:03:6d:5b:4c:94:22:08:a5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\NSEC-Client-Kernel\Drivers\NSecKrnl\NSecKrnl\bin\NSecKrnl32.pdb

Imports

ntoskrnl.exe

IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
PsSetCreateProcessNotifyRoutine
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
ExGetPreviousMode
ObfDereferenceObject
ZwClose
ExRaiseAccessViolation
PsGetCurrentProcessId
IofCompleteRequest
ZwTerminateProcess
PsLookupProcessByProcessId
ObOpenObjectByPointer
PsProcessType
MmUserProbeAddress
MmProbeAndLockPages
MmUnlockPages
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
ZwOpenProcess
KeServiceDescriptorTable
IoCreateDevice
RtlUnwind
RtlInitUnicodeString
KeBugCheckEx

hal

KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 956B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 998B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/nskrnl/NSecKrnl64.sys
.sys windows:10 windows x64 arch:x64

fdbdf8ea09a9af32d54979c574260475

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:73:52:94:cc:d4:a2:bc:58:49:28:45:7f:e7:2c:62
Certificate

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/03/2020, 00:00

Not After

22/03/2021, 12:00

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,POSTALCODE=250101,STREET=高新区新泺大街2008号银荷大厦C座606,L=Jinan,ST=Shandong,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13054a696e616e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:97:4d:45:a3:88:61:c1:5e:d3:f0:31:a1:70:4c:65
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

14/10/2019, 00:00

Not After

12/12/2020, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

26:53:de:e6:5a:14:a0:47:a5:8b:3a:b2:9b:93:e4:b7:f8:ad:8f:43:c8:ce:91:a1:85:86:ba:a5:9b:c7:9b:c4
Signer

Actual PE Digest

26:53:de:e6:5a:14:a0:47:a5:8b:3a:b2:9b:93:e4:b7:f8:ad:8f:43:c8:ce:91:a1:85:86:ba:a5:9b:c7:9b:c4

Digest Algorithm

sha256

PE Digest Matches

true

24:c2:8e:dd:5c:7f:89:a9:94:bb:9c:b0:26:19:f8:b5:fe:e5:8a:a4
Signer

Actual PE Digest

24:c2:8e:dd:5c:7f:89:a9:94:bb:9c:b0:26:19:f8:b5:fe:e5:8a:a4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\NSEC-Client-Kernel\Drivers\NSecKrnl\NSecKrnl\bin\NSecKrnl64.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
PsSetCreateProcessNotifyRoutine
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
IoGetCurrentProcess
ObfDereferenceObject
ObRegisterCallbacks
ObUnRegisterCallbacks
ZwClose
PsGetCurrentProcessId
PsGetProcessId
ZwTerminateProcess
PsLookupProcessByProcessId
ObOpenObjectByPointer
PsProcessType

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 914B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 832B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/nskrnl/win10/NSecKrnl32.sys
.sys windows:10 windows x86 arch:x86

43d6635c25768f0c25b05a011b1b35ba

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:5b:27:84:03:2c:07:b5:e6:3d:bb:a7:be:59:71:0d
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/04/2020, 00:00

Not After

22/03/2021, 12:00

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,POSTALCODE=250101,STREET=高新区新泺大街2008号银荷大厦C座606,L=Jinan,ST=Shandong,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13054a696e616e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:97:d7:9f:85:90:6e:a3:18:a4:00:00:00:00:00:97
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/03/2020, 17:47

Not After

05/03/2021, 17:47

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

da:ee:03:07:26:00:fa:13:5d:51:8e:63:e2:fa:d1:b0:e4:52:dd:20:3b:53:56:5d:45:d1:38:13:63:96:ef:22
Signer

Actual PE Digest

da:ee:03:07:26:00:fa:13:5d:51:8e:63:e2:fa:d1:b0:e4:52:dd:20:3b:53:56:5d:45:d1:38:13:63:96:ef:22

Digest Algorithm

sha256

PE Digest Matches

true

da:ee:03:07:26:00:fa:13:5d:51:8e:63:e2:fa:d1:b0:e4:52:dd:20:3b:53:56:5d:45:d1:38:13:63:96:ef:22
Signer

Actual PE Digest

da:ee:03:07:26:00:fa:13:5d:51:8e:63:e2:fa:d1:b0:e4:52:dd:20:3b:53:56:5d:45:d1:38:13:63:96:ef:22

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\NSEC-Client-Kernel\Drivers\NSecKrnl\NSecKrnl\bin\NSecKrnl32.pdb

Imports

ntoskrnl.exe

IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
PsSetCreateProcessNotifyRoutine
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
ExGetPreviousMode
ObfDereferenceObject
ZwClose
ExRaiseAccessViolation
PsGetCurrentProcessId
IofCompleteRequest
ZwTerminateProcess
PsLookupProcessByProcessId
ObOpenObjectByPointer
PsProcessType
MmUserProbeAddress
MmProbeAndLockPages
MmUnlockPages
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
ZwOpenProcess
KeServiceDescriptorTable
IoCreateDevice
RtlUnwind
RtlInitUnicodeString
KeBugCheckEx

hal

KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 956B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1024B - Virtual size: 998B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 292B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/nskrnl/win10/NSecKrnl64.sys
.sys windows:10 windows x64 arch:x64

fdbdf8ea09a9af32d54979c574260475

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:5b:27:84:03:2c:07:b5:e6:3d:bb:a7:be:59:71:0d
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

28/04/2020, 00:00

Not After

22/03/2021, 12:00

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,POSTALCODE=250101,STREET=高新区新泺大街2008号银荷大厦C座606,L=Jinan,ST=Shandong,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13054a696e616e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e646f6e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:97:d7:9f:85:90:6e:a3:18:a4:00:00:00:00:00:97
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/03/2020, 17:47

Not After

05/03/2021, 17:47

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0b:aa:c1:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/04/2012, 23:48

Not After

18/04/2027, 23:58

Subject

CN=Microsoft Windows Third Party Component CA 2012,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:24:c6:91:23:d4:a7:24:45:54:7f:7b:5a:d6:73:8f:b4:7f:2d:3f:ab:06:e3:d6:28:b7:27:81:13:a6:3a:e0
Signer

Actual PE Digest

cf:24:c6:91:23:d4:a7:24:45:54:7f:7b:5a:d6:73:8f:b4:7f:2d:3f:ab:06:e3:d6:28:b7:27:81:13:a6:3a:e0

Digest Algorithm

sha256

PE Digest Matches

true

cf:24:c6:91:23:d4:a7:24:45:54:7f:7b:5a:d6:73:8f:b4:7f:2d:3f:ab:06:e3:d6:28:b7:27:81:13:a6:3a:e0
Signer

Actual PE Digest

cf:24:c6:91:23:d4:a7:24:45:54:7f:7b:5a:d6:73:8f:b4:7f:2d:3f:ab:06:e3:d6:28:b7:27:81:13:a6:3a:e0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\NSEC-Client-Kernel\Drivers\NSecKrnl\NSecKrnl\bin\NSecKrnl64.pdb

Imports

ntoskrnl.exe

RtlInitUnicodeString
IofCompleteRequest
IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
PsSetCreateProcessNotifyRoutine
PsSetLoadImageNotifyRoutine
PsRemoveLoadImageNotifyRoutine
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
IoGetCurrentProcess
ObfDereferenceObject
ObRegisterCallbacks
ObUnRegisterCallbacks
ZwClose
PsGetCurrentProcessId
PsGetProcessId
ZwTerminateProcess
PsLookupProcessByProcessId
ObOpenObjectByPointer
PsProcessType

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 1024B - Virtual size: 914B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 840B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/ntdes/arm/nxdds2.dll
.sys windows:10 windows x86 arch:x86

18470b669f23772a7423816aae553f7c

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ba:0c:bd:48:e2:e7:a4:8e:d8:c3:d4:37:95:39:a0:be:17:22:8a:a9:35:9b:b1:93:f9:32:e8:60:4f:0f:3e:82
Signer

Actual PE Digest

ba:0c:bd:48:e2:e7:a4:8e:d8:c3:d4:37:95:39:a0:be:17:22:8a:a9:35:9b:b1:93:f9:32:e8:60:4f:0f:3e:82

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\Release\NxdDs2.pdb

Imports

fltmgr.sys

FltAllocateContext
FltSetInstanceContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetStreamContext
FltGetStreamHandleContext
FltReferenceContext
FltReleaseContext
FltSetCallbackDataDirty
FltQueryVolumeInformationFile
FltCancelFileOpen
FltFindExtraCreateParameter
FltReleaseFileNameInformation
FltParseFileNameInformation
FltCreateFile
FltClose
FltGetUpperInstance
FltObjectDereference
FltAllocateExtraCreateParameterList
FltRemoveExtraCreateParameter
FltFreeExtraCreateParameterList
FltFreeExtraCreateParameter
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltDetachVolume
FltGetDeviceObject
FltQueryInformationFile
FltFsControlFile
FltSetInformationFile
FltAllocateCallbackData
FltFreeCallbackData
FltPerformSynchronousIo
FltAllocateCallbackDataEx
FltReuseCallbackData
FltQueryVolumeInformation
FltReadFile
FltWriteFile
FltGetFileNameInformationUnsafe
FltAllocateExtraCreateParameter
FltGetEcpListFromCallbackData
FltSetEcpListIntoCallbackData
FltGetRoutineAddress
FltCreateFileEx2
FltOplockFsctrl
FltCheckOplock

ntoskrnl.exe

PsGetCurrentThreadId
FsRtlIsPagingFile
memset
DbgPrint
CcGetFileObjectFromSectionPtrs
ExRaiseStatus
ExIsResourceAcquiredExclusiveLite
memcpy
KeGetCurrentThread
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
ProbeForWrite
MmProbeAndLockPages
ExFreePoolWithTag
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
ObfDereferenceObject
ZwClose
SeTokenType
SeCreateClientSecurity
SeImpersonateClientEx
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
PsRevertToSelf
ObOpenObjectByPointer
FsRtlInsertExtraCreateParameter
IoFileObjectType
SeSinglePrivilegeCheck
SeExports
RtlInitUnicodeString
RtlGetVersion
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlEqualUnicodeString
KeDelayExecutionThread
KeAreAllApcsDisabled
IoGetCurrentProcess
ExAcquireResourceExclusiveLite
ExSetResourceOwnerPointer
ExIsResourceAcquiredSharedLite
KeExpandKernelStackAndCalloutEx
ExAcquireSharedStarveExclusive
RtlCompareMemory
_aullrem
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
IoAllocateIrp
IofCallDriver
IoFreeIrp
ObReferenceObjectByHandle
ZwCreateFile
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeAreApcsDisabled
ExAcquireResourceSharedLite
ExReleaseResourceForThreadLite
MmIsDriverVerifying
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
FsRtlAllocateExtraCreateParameter
FsRtlIsEcpFromUserMode
FsRtlAreVolumeStartupApplicationsComplete
FsRtlIsNtstatusExpected
RtlQueryRegistryValues
RtlIsNtDdiVersionAvailable
IoGetTransactionParameterBlock
ExReleaseResourceLite
ObfReferenceObject
IoGetLowerDeviceObject
IoGetDeviceAttachmentBaseRef
KeBugCheckEx
ExAllocatePoolWithTag
RtlUnwind
MmUnlockPages

hal

KeGetCurrentIrql

Sections

.text
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/ntdes/arm/nxdds2.inf
drivers/ntdes/arm/nxddt2.dll
.sys windows:10 windows x86 arch:x86

1216db4b536fdd5d00af68ef963c4e96

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4a:b2:b6:04:bd:14:75:b2:82:a0:c0:68:82:41:04:b4:38:c1:65:eb:cc:c9:6b:04:63:d8:e7:5a:59:a8:89:aa
Signer

Actual PE Digest

4a:b2:b6:04:bd:14:75:b2:82:a0:c0:68:82:41:04:b4:38:c1:65:eb:cc:c9:6b:04:63:d8:e7:5a:59:a8:89:aa

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\Release\NxdDt2.pdb

Imports

cng.sys

BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDestroyKey
BCryptDecrypt
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGetProperty
BCryptDestroyHash
BCryptOpenAlgorithmProvider

fltmgr.sys

FltInsertExtraCreateParameter
FltIsVolumeSnapshot
FltGetDestinationFileNameInformation
FltPerformSynchronousIo
FltFreeCallbackData
FltCheckOplock
FltOplockFsctrl
FltGetRoutineAddress
FltSetEcpListIntoCallbackData
FltGetVolumeGuidName
FltGetFileNameInformationUnsafe
FltGetVolumeFromInstance
FltAllocateCallbackData
FltAllocateContext
FltSetInstanceContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetStreamContext
FltGetStreamHandleContext
FltReferenceContext
FltReleaseContext
FltSetCallbackDataDirty
FltGetFileNameInformation
FltReleaseFileNameInformation
FltParseFileNameInformation
FltCreateFileEx2
FltWriteFile
FltSetInformationFile
FltQueryVolumeInformationFile
FltFlushBuffers
FltFsControlFile
FltReissueSynchronousIo
FltClose
FltCancelFileOpen
FltAllocateExtraCreateParameterList
FltAllocateExtraCreateParameter
FltGetUpperInstance
FltFindExtraCreateParameter
FltRemoveExtraCreateParameter
FltFreeExtraCreateParameterList
FltFreeExtraCreateParameter
FltGetEcpListFromCallbackData
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltAttachVolume
FltDetachVolume
FltGetFilterFromName
FltGetVolumeInstanceFromName
FltGetDiskDeviceObject
FltGetInstanceInformation
FltObjectDereference
FltQueryInformationFile
FltLoadFilter
FltGetRequestorProcess

ntoskrnl.exe

PsLookupThreadByThreadId
PsGetThreadProcess
memset
KeReadStateEvent
KeSetEvent
KeWaitForSingleObject
ExIsResourceAcquiredExclusiveLite
IofCompleteRequest
IoCsqInsertIrp
IoCsqRemoveNextIrp
FsRtlCancellableWaitForSingleObject
memcpy
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlFreeUnicodeString
PsSetCreateProcessNotifyRoutineEx
KeClearEvent
IoAllocateErrorLogEntry
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoWriteErrorLogEntry
IoCsqInitialize
PsGetCurrentProcessId
PsGetThreadProcessId
InitSafeBootMode
PsGetThreadId
DbgPrint
FsRtlIsPagingFile
RtlEqualUnicodeString
RtlIsNtDdiVersionAvailable
KeAreAllApcsDisabled
IoGetCurrentProcess
ZwClose
ZwCreateSection
FsRtlFreeExtraCreateParameter
FsRtlInsertExtraCreateParameter
FsRtlFindExtraCreateParameter
FsRtlRemoveExtraCreateParameter
PsInitialSystemProcess
RtlCompareMemory
MmMapLockedPagesSpecifyCache
ZwCreateKey
ZwOpenKey
ZwEnumerateValueKey
ZwQueryValueKey
KeEnterGuardedRegion
KeLeaveGuardedRegion
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
SeSinglePrivilegeCheck
SeExports
RtlInitUnicodeString
RtlGetVersion
MmGetSystemRoutineAddress
SeCaptureSubjectContext
SeReleaseSubjectContext
IoWMIRegistrationControl
ExUuidCreate
FsRtlGetNextExtraCreateParameter
MmProbeAndLockPages
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoFreeMdl
RtlUpcaseUnicodeChar
TmGetTransactionId
ObQueryNameString
_stricmp
RtlUpperChar
RtlPrefixUnicodeString
IoVolumeDeviceToDosName
FsRtlAreNamesEqual
PsGetProcessImageFileName
KeGetCurrentThread
IoAllocateIrp
IofCallDriver
IoFreeIrp
ObReferenceObjectByHandle
ZwCreateFile
IoFileObjectType
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeAreApcsDisabled
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceForThreadLite
ExSetResourceOwnerPointerEx
MmIsDriverVerifying
FsRtlIsNameInExpression
KdDebuggerNotPresent
KdDebuggerEnabled
RtlQueryRegistryValues
RtlGUIDFromString
FsRtlAllocateExtraCreateParameter
FsRtlIsEcpFromUserMode
FsRtlAreVolumeStartupApplicationsComplete
memmove
IoGetTransactionParameterBlock
FsRtlIsNtstatusExpected
KeBugCheckEx
RtlSetDaclSecurityDescriptor
RtlUnwind
ObfDereferenceObject
ExIsResourceAcquiredSharedLite
ExFreePoolWithTag
ExAllocatePoolWithTag
PsGetCurrentThreadId
KeInitializeEvent
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
ObOpenObjectByPointer
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
ZwSetValueKey

hal

KfAcquireSpinLock
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
KfReleaseSpinLock
KeGetCurrentIrql

Sections

.text
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/ntdes/arm/nxddt2.inf
drivers/ntdes/arm/nxdisolate.dll
.sys windows:10 windows x86 arch:x86

92d4d0dc9a0ca6b63f06a872f186d28b

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:16:fd:a4:d7:86:86:e5:f7:06:f5:aa:f8:ef:b0:0c:74:c9:56:d4:16:80:b1:08:7a:00:7f:f4:0f:f7:bc:1a
Signer

Actual PE Digest

39:16:fd:a4:d7:86:86:e5:f7:06:f5:aa:f8:ef:b0:0c:74:c9:56:d4:16:80:b1:08:7a:00:7f:f4:0f:f7:bc:1a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\Release\NxdIsolate.pdb

Imports

fltmgr.sys

FltSetCallbackDataDirty
FltReleaseContext
FltQueryInformationFile
FltSetInformationFile
FltClose
FltDetachVolume
FltAllocateContext
FltSetInstanceContext
FltSetFileContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetFileContext
FltGetStreamContext
FltGetStreamHandleContext
FltFreeFileLock
FltFindExtraCreateParameter
FltParseFileNameInformation
FltCreateFileEx
FltFsControlFile
FltCancelFileOpen
FltOplockFsctrl
FltAllocateExtraCreateParameterList
FltRemoveExtraCreateParameter
FltGetNextExtraCreateParameter
FltReleaseFileNameInformation
FltFreeExtraCreateParameterList
FltGetEcpListFromCallbackData
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltGetDeviceObject
FltGetDiskDeviceObject
FltIsVolumeWritable
FltIsVolumeSnapshot
FltQueryVolumeInformation
FltCompletePendedPreOperation
FltIsIoCanceled
FltCompletePendedPostOperation
FltAllocateCallbackData
FltFreeCallbackData
FltReuseCallbackData
FltPerformSynchronousIo
FltAllocateFileLock
FltProcessFileLock
FltGetRequestorProcess
FltCheckAndGrowNameControl
FltGetFileNameInformation
FltGetFileNameInformationUnsafe
FltQueryDirectoryFile
FltCheckOplock
FltOplockIsFastIoPossible
FltOplockBreakH
FltOplockIsSharedRequest
FltReissueSynchronousIo
FltCheckLockForReadAccess
FltIsOperationSynchronous
FltGetDestinationFileNameInformation
FltWriteFile
FltGetVolumeFromInstance
FltGetTopInstance
FltObjectDereference
FltCheckLockForWriteAccess
FltGetRoutineAddress
FltCreateFileEx2

ntoskrnl.exe

KeDelayExecutionThread
KeEnterGuardedRegion
KeLeaveGuardedRegion
KeWaitForSingleObject
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
ExIsResourceAcquiredExclusiveLite
ExIsResourceAcquiredSharedLite
MmGetSystemRoutineAddress
IoGetStackLimits
IoWithinStackLimits
ObfReferenceObject
ObfDereferenceObject
ObDereferenceObjectDeferDelete
PsGetCurrentThreadId
PsIsSystemThread
MmCanFileBeTruncated
FsRtlIsNtstatusExpected
FsRtlChangeBackingFileObject
CcInitializeCacheMap
CcUninitializeCacheMap
CcPurgeCacheSection
CcFlushCache
CcGetFileObjectFromSectionPtrsRef
CcSetReadAheadGranularity
CcSetAdditionalCacheAttributes
memset
RtlFreeUnicodeString
RtlStringFromGUID
KeQuerySystemTime
ExAllocatePoolWithTag
ExFreePoolWithTag
ExGetPreviousMode
ExUuidCreate
CcSetFileSizes
memcpy
ExInitializeResourceLite
ExDeleteResourceLite
KeSetEvent
FsRtlTeardownPerFileContexts
FsRtlTeardownPerStreamContexts
FsRtlInsertPerFileObjectContext
FsRtlLookupPerFileObjectContext
FsRtlRemovePerFileObjectContext
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
MmDoesFileHaveUserWritableReferences
KeExpandKernelStackAndCalloutEx
IoIsFileObjectIgnoringSharing
FsRtlCurrentBatchOplock
FsRtlInsertExtraCreateParameter
RtlEqualUnicodeString
SeTokenType
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
FsRtlDissectName
RtlCompareUnicodeString
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
RtlLookupFirstMatchingElementGenericTableAvl
RtlGetElementGenericTableAvl
RtlNumberGenericTableElementsAvl
RtlIsGenericTableEmptyAvl
IoGetCurrentProcess
ObReferenceObjectByHandle
SeSinglePrivilegeCheck
NtClose
KeStackAttachProcess
KeUnstackDetachProcess
IoAcquireVpbSpinLock
IoReleaseVpbSpinLock
ObOpenObjectByPointer
IoFileObjectType
SeExports
RtlInitUnicodeString
RtlGetVersion
IoWMIRegistrationControl
PsGetCurrentProcessId
FsRtlGetNextFileLock
FsRtlFastUnlockSingle
FsRtlFastUnlockAll
FsRtlFastUnlockAllByKey
FsRtlPrivateLock
KeAreApcsDisabled
KeAreAllApcsDisabled
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExSetResourceOwnerPointerEx
MmFlushImageSection
CcZeroData
MmForceSectionClosed
ExRaiseStatus
IoGetTopLevelIrp
SeCreateClientSecurity
SeImpersonateClientEx
PsRevertToSelf
FsRtlInitializeOplock
FsRtlOplockKeysEqual
FsRtlIsPagingFile
MmMapLockedPagesSpecifyCache
FsRtlMdlReadCompleteDev
CcCopyRead
CcMdlRead
ExReleaseResourceForThreadLite
FsRtlCurrentOplockH
RtlCompareMemory
RtlCaptureStackBackTrace
FsRtlCancellableWaitForSingleObject
CcSetFileSizesEx
MmProbeAndLockPages
IoAllocateMdl
IoFreeMdl
PsGetThreadProcessId
FsRtlMdlWriteCompleteDev
FsRtlFastCheckLockForRead
FsRtlFastCheckLockForWrite
CcCanIWrite
CcDeferWrite
CcCopyWrite
CcPrepareMdlWrite
IoAllocateIrp
IofCallDriver
IoFreeIrp
ZwCreateFile
ZwClose
DbgPrint
KeEnterCriticalRegion
KeLeaveCriticalRegion
MmIsDriverVerifying
FsRtlIsNameInExpression
KdDebuggerNotPresent
KdDebuggerEnabled
IoGetLowerDeviceObject
IoGetDeviceAttachmentBaseRef
IoGetTransactionParameterBlock
RtlQueryRegistryValues
KeBugCheckEx
KeGetCurrentThread
RtlUnwind
KeInitializeEvent
RtlIsNtDdiVersionAvailable
FsRtlUninitializeOplock

hal

ExReleaseFastMutex
ExAcquireFastMutex
KeGetCurrentIrql

Sections

.text
Size: 215KB - Virtual size: 214KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/ntdes/arm/nxdisolate.inf
drivers/ntdes/arm/nxdsupport.dll
.sys windows:10 windows x86 arch:x86

923fa89055fa581e9feaa737a5eaa8b7

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:c1:d5:3c:56:b6:87:39:c2:8c:7c:d5:2f:52:de:b8:d0:86:7e:92:86:ab:5e:35:e0:78:f5:83:fb:22:a8:c6
Signer

Actual PE Digest

30:c1:d5:3c:56:b6:87:39:c2:8c:7c:d5:2f:52:de:b8:d0:86:7e:92:86:ab:5e:35:e0:78:f5:83:fb:22:a8:c6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\Release\NxdSupport.pdb

Imports

fltmgr.sys

FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltReleaseFileNameInformation
FltGetVolumeName
FltCreateFileEx
FltClose
FltIsVolumeSnapshot
FltObjectReference
FltObjectDereference
FltAllocateCallbackData
FltFreeCallbackData
FltReuseCallbackData
FltPerformSynchronousIo
FltReadFile
FltGetRoutineAddress
FltOplockFsctrl
FltCheckOplock
FltGetFileNameInformationUnsafe
FltGetVolumeGuidName

ntoskrnl.exe

KeBugCheckEx
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
ExConvertExclusiveToSharedLite
ExDeleteResourceLite
ExIsResourceAcquiredSharedLite
memset
KeDelayExecutionThread
KeAreApcsDisabled
ExAllocatePoolWithTag
ExFreePoolWithTag
PsGetCurrentThreadId
RtlInitUnicodeString
RtlWriteRegistryValue
RtlUnicodeStringToAnsiString
RtlEqualUnicodeString
RtlFreeUnicodeString
RtlStringFromGUID
RtlGetVersion
MmGetSystemRoutineAddress
IoWMIRegistrationControl
ExUuidCreate
memcpy
KeInitializeEvent
KeClearEvent
KeReadStateEvent
KeSetEvent
KeSetPriorityThread
KeWaitForSingleObject
KeQuerySystemTime
KeQueryActiveProcessorCount
ExAcquireSpinLockShared
ExReleaseSpinLockShared
ExAcquireSpinLockExclusiveAtDpcLevel
ExAcquireSpinLockExclusive
ExReleaseSpinLockExclusiveFromDpcLevel
ExReleaseSpinLockExclusive
PsCreateSystemThread
PsTerminateSystemThread
ZwClose
KeInitializeQueue
KeInsertQueue
KeRemoveQueue
KeRundownQueue
ZwWaitForSingleObject
_alldiv
_aulldiv
RtlCopyUnicodeString
PsSetCreateThreadNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
ObOpenObjectByPointer
KeLeaveGuardedRegion
RtlIntegerToUnicodeString
RtlAppendUnicodeStringToString
IoAllocateErrorLogEntry
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoWriteErrorLogEntry
ObfDereferenceObject
ObDereferenceObjectDeferDelete
PsSetCreateProcessNotifyRoutineEx
PsGetThreadProcessId
ZwOpenProcess
RtlValidSid
RtlEqualSid
RtlLengthRequiredSid
RtlConvertSidToUnicodeString
PsLookupProcessByProcessId
PsLookupThreadByThreadId
ZwOpenProcessTokenEx
ZwOpenThreadTokenEx
ZwQueryInformationToken
PsGetProcessExitProcessCalled
ZwOpenThread
PsInitialSystemProcess
ExIsResourceAcquiredExclusiveLite
RtlPrefixUnicodeString
memmove
FsRtlCancellableWaitForMultipleObjects
CcWaitForCurrentLazyWriterActivity
_allmul
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmIsDriverVerifying
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
RtlQueryRegistryValues
RtlIsNtDdiVersionAvailable
FsRtlIsNtstatusExpected
RtlGUIDFromString
FsRtlAreVolumeStartupApplicationsComplete
KeGetCurrentThread
RtlUnwind
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeExports
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
RtlSetDaclSecurityDescriptor
ZwOpenKey
ZwSetValueKey
ZwQueryValueKey
ZwCreateKey
KeEnterGuardedRegion
KeLeaveCriticalRegion
KeEnterCriticalRegion
DbgPrint
PsProcessType

hal

KfAcquireSpinLock
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
KeGetCurrentIrql
KfReleaseSpinLock

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/ntdes/arm/nxdsupport.inf
drivers/ntdes/arm64/nxdds2.dll
.sys windows:10 windows x64 arch:x64

c9ec52e601e85543421efa1d07746e6d

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ba:7d:cb:f5:e7:2d:e5:b3:55:c6:06:2e:3f:f3:42:5b:e1:72:de:af:ae:2b:1f:0a:54:40:cd:f6:77:d6:be:46
Signer

Actual PE Digest

ba:7d:cb:f5:e7:2d:e5:b3:55:c6:06:2e:3f:f3:42:5b:e1:72:de:af:ae:2b:1f:0a:54:40:cd:f6:77:d6:be:46

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\x64\Release\NxdDs2.pdb

Imports

fltmgr.sys

FltAllocateContext
FltSetInstanceContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetStreamContext
FltGetStreamHandleContext
FltReferenceContext
FltReleaseContext
FltSetCallbackDataDirty
FltQueryVolumeInformationFile
FltCancelFileOpen
FltFindExtraCreateParameter
FltReleaseFileNameInformation
FltParseFileNameInformation
FltCreateFile
FltClose
FltGetUpperInstance
FltObjectDereference
FltAllocateExtraCreateParameterList
FltRemoveExtraCreateParameter
FltFreeExtraCreateParameterList
FltFreeExtraCreateParameter
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltDetachVolume
FltGetDeviceObject
FltQueryInformationFile
FltFsControlFile
FltSetInformationFile
FltAllocateCallbackData
FltFreeCallbackData
FltPerformSynchronousIo
FltAllocateCallbackDataEx
FltReuseCallbackData
FltQueryVolumeInformation
FltReadFile
FltWriteFile
FltGetFileNameInformationUnsafe
FltAllocateExtraCreateParameter
FltGetEcpListFromCallbackData
FltSetEcpListIntoCallbackData
FltGetRoutineAddress
FltCreateFileEx2
FltOplockFsctrl
FltCheckOplock

ntoskrnl.exe

ExAllocatePoolWithTag
ExFreePoolWithTag
PsGetCurrentThreadId
FsRtlIsPagingFile
DbgPrint
CcGetFileObjectFromSectionPtrs
ExRaiseStatus
ExIsResourceAcquiredExclusiveLite
__C_specific_handler
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
ProbeForWrite
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
ObfDereferenceObject
ZwClose
SeTokenType
SeCreateClientSecurity
SeImpersonateClientEx
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
PsRevertToSelf
ObOpenObjectByPointer
FsRtlInsertExtraCreateParameter
IoFileObjectType
SeSinglePrivilegeCheck
SeExports
RtlInitUnicodeString
RtlGetVersion
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlEqualUnicodeString
KeDelayExecutionThread
KeAreAllApcsDisabled
IoGetCurrentProcess
ExAcquireResourceExclusiveLite
ExSetResourceOwnerPointer
ExIsResourceAcquiredSharedLite
KeExpandKernelStackAndCalloutEx
ExAcquireSharedStarveExclusive
RtlCompareMemory
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
IoAllocateIrp
IofCallDriver
IoFreeIrp
ObReferenceObjectByHandle
ZwCreateFile
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeAreApcsDisabled
ExAcquireResourceSharedLite
ExReleaseResourceForThreadLite
MmIsDriverVerifying
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
FsRtlAllocateExtraCreateParameter
FsRtlIsEcpFromUserMode
FsRtlAreVolumeStartupApplicationsComplete
FsRtlIsNtstatusExpected
RtlQueryRegistryValues
RtlIsNtDdiVersionAvailable
IoGetTransactionParameterBlock
ExReleaseResourceLite
ObfReferenceObject
IoGetLowerDeviceObject
IoGetDeviceAttachmentBaseRef
KeBugCheckEx

Sections

.text
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/ntdes/arm64/nxdds2.inf
drivers/ntdes/arm64/nxddt2.dll
.sys windows:10 windows x64 arch:x64

d4aaa56737d8968585b8332f5f3d6fde

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:e2:1d:2e:d8:5e:e2:3d:dc:b8:a1:10:f8:08:ae:7c:54:d2:0f:51:64:9a:f2:c9:3f:b0:4e:d7:4d:17:32:cf
Signer

Actual PE Digest

7e:e2:1d:2e:d8:5e:e2:3d:dc:b8:a1:10:f8:08:ae:7c:54:d2:0f:51:64:9a:f2:c9:3f:b0:4e:d7:4d:17:32:cf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\x64\Release\NxdDt2.pdb

Imports

cng.sys

BCryptDecrypt
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGetProperty

fltmgr.sys

FltAllocateExtraCreateParameterList
FltCheckOplock
FltOplockFsctrl
FltGetRoutineAddress
FltSetEcpListIntoCallbackData
FltGetVolumeGuidName
FltGetFileNameInformationUnsafe
FltGetVolumeFromInstance
FltGetRequestorProcess
FltIsVolumeSnapshot
FltGetDestinationFileNameInformation
FltPerformSynchronousIo
FltFreeCallbackData
FltAllocateContext
FltSetInstanceContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetStreamContext
FltGetStreamHandleContext
FltReferenceContext
FltReleaseContext
FltSetCallbackDataDirty
FltGetFileNameInformation
FltReleaseFileNameInformation
FltParseFileNameInformation
FltCreateFileEx2
FltWriteFile
FltSetInformationFile
FltQueryVolumeInformationFile
FltFlushBuffers
FltFsControlFile
FltReissueSynchronousIo
FltClose
FltCancelFileOpen
FltGetUpperInstance
FltAllocateExtraCreateParameter
FltInsertExtraCreateParameter
FltFindExtraCreateParameter
FltRemoveExtraCreateParameter
FltFreeExtraCreateParameterList
FltFreeExtraCreateParameter
FltGetEcpListFromCallbackData
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltAttachVolume
FltDetachVolume
FltGetFilterFromName
FltGetVolumeInstanceFromName
FltGetDiskDeviceObject
FltGetInstanceInformation
FltObjectDereference
FltQueryInformationFile
FltLoadFilter
FltAllocateCallbackData

ntoskrnl.exe

ExAllocatePoolWithTag
ExFreePoolWithTag
ExIsResourceAcquiredSharedLite
ObfDereferenceObject
PsSetCreateProcessNotifyRoutineEx
PsGetCurrentThreadId
PsLookupThreadByThreadId
PsGetThreadProcess
KeReadStateEvent
KeSetEvent
KeWaitForSingleObject
ExIsResourceAcquiredExclusiveLite
IofCompleteRequest
IoCsqInsertIrp
IoCsqRemoveNextIrp
FsRtlCancellableWaitForSingleObject
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlFreeUnicodeString
KeInitializeEvent
KeClearEvent
IoAllocateErrorLogEntry
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoWriteErrorLogEntry
IoCsqInitialize
PsGetCurrentProcessId
PsGetThreadProcessId
InitSafeBootMode
PsGetThreadId
DbgPrint
FsRtlIsPagingFile
RtlEqualUnicodeString
RtlIsNtDdiVersionAvailable
KeAreAllApcsDisabled
IoGetCurrentProcess
ZwClose
ZwCreateSection
FsRtlFreeExtraCreateParameter
FsRtlInsertExtraCreateParameter
FsRtlFindExtraCreateParameter
FsRtlRemoveExtraCreateParameter
PsInitialSystemProcess
RtlCompareMemory
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
MmMapLockedPagesSpecifyCache
ZwCreateKey
ZwOpenKey
ZwEnumerateValueKey
ZwQueryValueKey
KeEnterGuardedRegion
KeLeaveGuardedRegion
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
SeSinglePrivilegeCheck
SeExports
RtlInitUnicodeString
RtlGetVersion
MmGetSystemRoutineAddress
SeCaptureSubjectContext
SeReleaseSubjectContext
IoWMIRegistrationControl
ExUuidCreate
FsRtlGetNextExtraCreateParameter
MmProbeAndLockPages
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoFreeMdl
__C_specific_handler
RtlUpcaseUnicodeChar
TmGetTransactionId
ObQueryNameString
_stricmp
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
RtlUpperChar
RtlPrefixUnicodeString
IoVolumeDeviceToDosName
FsRtlAreNamesEqual
PsGetProcessImageFileName
IoAllocateIrp
IofCallDriver
IoFreeIrp
ObReferenceObjectByHandle
ZwCreateFile
IoFileObjectType
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeAreApcsDisabled
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceForThreadLite
ExSetResourceOwnerPointerEx
MmIsDriverVerifying
FsRtlIsNameInExpression
KdDebuggerNotPresent
KdDebuggerEnabled
RtlQueryRegistryValues
RtlGUIDFromString
FsRtlAllocateExtraCreateParameter
FsRtlIsEcpFromUserMode
FsRtlAreVolumeStartupApplicationsComplete
IoGetTransactionParameterBlock
FsRtlIsNtstatusExpected
KeBugCheckEx
RtlSetDaclSecurityDescriptor
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
ObOpenObjectByPointer
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
ZwSetValueKey

Sections

.text
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/ntdes/arm64/nxddt2.inf
drivers/ntdes/arm64/nxdisolate.dll
.sys windows:10 windows x64 arch:x64

822a8ef20c160880bf6f7622d7f26af0

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b2:f8:31:e4:bc:67:b6:6f:30:3c:5f:e4:6d:40:e7:69:0c:83:df:a8:4a:43:01:18:2e:a4:33:48:55:3c:78:2b
Signer

Actual PE Digest

b2:f8:31:e4:bc:67:b6:6f:30:3c:5f:e4:6d:40:e7:69:0c:83:df:a8:4a:43:01:18:2e:a4:33:48:55:3c:78:2b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\x64\Release\NxdIsolate.pdb

Imports

fltmgr.sys

FltSetCallbackDataDirty
FltReleaseContext
FltQueryInformationFile
FltSetInformationFile
FltClose
FltDetachVolume
FltAllocateContext
FltSetInstanceContext
FltSetFileContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetFileContext
FltGetStreamContext
FltGetStreamHandleContext
FltFreeFileLock
FltFindExtraCreateParameter
FltParseFileNameInformation
FltCreateFileEx
FltFsControlFile
FltCancelFileOpen
FltOplockFsctrl
FltAllocateExtraCreateParameterList
FltRemoveExtraCreateParameter
FltGetNextExtraCreateParameter
FltReleaseFileNameInformation
FltFreeExtraCreateParameterList
FltGetEcpListFromCallbackData
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltGetDeviceObject
FltGetDiskDeviceObject
FltIsVolumeWritable
FltIsVolumeSnapshot
FltQueryVolumeInformation
FltCompletePendedPreOperation
FltIsIoCanceled
FltIs32bitProcess
FltCompletePendedPostOperation
FltAllocateCallbackData
FltFreeCallbackData
FltReuseCallbackData
FltPerformSynchronousIo
FltAllocateFileLock
FltProcessFileLock
FltGetRequestorProcess
FltCheckAndGrowNameControl
FltGetFileNameInformation
FltGetFileNameInformationUnsafe
FltQueryDirectoryFile
FltCheckOplock
FltOplockIsFastIoPossible
FltOplockBreakH
FltOplockIsSharedRequest
FltReissueSynchronousIo
FltCheckLockForReadAccess
FltIsOperationSynchronous
FltGetDestinationFileNameInformation
FltWriteFile
FltGetVolumeFromInstance
FltGetTopInstance
FltObjectDereference
FltCheckLockForWriteAccess
FltGetRoutineAddress
FltCreateFileEx2

ntoskrnl.exe

RtlIsNtDdiVersionAvailable
KeInitializeEvent
KeSetEvent
KeDelayExecutionThread
KeEnterGuardedRegion
KeLeaveGuardedRegion
KeWaitForSingleObject
ExAcquireFastMutex
ExReleaseFastMutex
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
ExIsResourceAcquiredExclusiveLite
ExIsResourceAcquiredSharedLite
MmGetSystemRoutineAddress
IoGetStackLimits
IoWithinStackLimits
ObfReferenceObject
ObfDereferenceObject
ObDereferenceObjectDeferDelete
PsGetCurrentThreadId
PsIsSystemThread
MmCanFileBeTruncated
FsRtlIsNtstatusExpected
FsRtlChangeBackingFileObject
CcInitializeCacheMap
CcUninitializeCacheMap
CcPurgeCacheSection
CcFlushCache
CcGetFileObjectFromSectionPtrsRef
CcSetReadAheadGranularity
CcSetAdditionalCacheAttributes
__C_specific_handler
RtlFreeUnicodeString
RtlStringFromGUID
ExAllocatePoolWithTag
ExFreePoolWithTag
ExGetPreviousMode
ExUuidCreate
CcSetFileSizes
ExInitializeResourceLite
ExDeleteResourceLite
FsRtlUninitializeOplock
FsRtlTeardownPerFileContexts
FsRtlTeardownPerStreamContexts
FsRtlInsertPerFileObjectContext
FsRtlLookupPerFileObjectContext
FsRtlRemovePerFileObjectContext
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
MmDoesFileHaveUserWritableReferences
KeExpandKernelStackAndCalloutEx
IoIsFileObjectIgnoringSharing
FsRtlCurrentBatchOplock
FsRtlInsertExtraCreateParameter
RtlEqualUnicodeString
SeTokenType
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
FsRtlDissectName
RtlCompareUnicodeString
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
RtlLookupFirstMatchingElementGenericTableAvl
RtlGetElementGenericTableAvl
RtlNumberGenericTableElementsAvl
RtlIsGenericTableEmptyAvl
IoGetCurrentProcess
ObReferenceObjectByHandle
SeSinglePrivilegeCheck
NtClose
KeStackAttachProcess
KeUnstackDetachProcess
IoAcquireVpbSpinLock
IoReleaseVpbSpinLock
ObOpenObjectByPointer
IoFileObjectType
SeExports
RtlInitUnicodeString
RtlGetVersion
IoWMIRegistrationControl
PsGetCurrentProcessId
FsRtlGetNextFileLock
FsRtlFastUnlockSingle
FsRtlFastUnlockAll
FsRtlFastUnlockAllByKey
FsRtlPrivateLock
KeAreApcsDisabled
KeAreAllApcsDisabled
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExSetResourceOwnerPointerEx
MmFlushImageSection
CcZeroData
MmForceSectionClosed
ExRaiseStatus
IoGetTopLevelIrp
SeCreateClientSecurity
SeImpersonateClientEx
PsRevertToSelf
FsRtlInitializeOplock
FsRtlOplockKeysEqual
FsRtlIsPagingFile
MmMapLockedPagesSpecifyCache
FsRtlMdlReadCompleteDev
CcCopyRead
CcMdlRead
ExReleaseResourceForThreadLite
FsRtlCurrentOplockH
RtlCompareMemory
RtlCaptureStackBackTrace
FsRtlCancellableWaitForSingleObject
CcSetFileSizesEx
MmProbeAndLockPages
IoAllocateMdl
IoFreeMdl
PsGetThreadProcessId
FsRtlMdlWriteCompleteDev
FsRtlFastCheckLockForRead
FsRtlFastCheckLockForWrite
CcCanIWrite
CcDeferWrite
CcCopyWrite
CcPrepareMdlWrite
IoAllocateIrp
IofCallDriver
IoFreeIrp
ZwCreateFile
ZwClose
DbgPrint
KeEnterCriticalRegion
KeLeaveCriticalRegion
MmIsDriverVerifying
FsRtlIsNameInExpression
KdDebuggerNotPresent
KdDebuggerEnabled
IoGetLowerDeviceObject
IoGetDeviceAttachmentBaseRef
IoGetTransactionParameterBlock
RtlQueryRegistryValues
KeBugCheckEx

Sections

.text
Size: 268KB - Virtual size: 267KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/ntdes/arm64/nxdisolate.inf
drivers/ntdes/arm64/nxdsupport.dll
.sys windows:10 windows x64 arch:x64

18fa52f66b992df95c74c3e25e408fdb

Code Sign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1f:b0:a4:00:00:00:00:00:1d
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:31

Not After

22/02/2021, 19:41

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:df:80:79:67:2b:96:c9:51:c5:1d:d7:f4:2b:9c:16:a1:27:c8:35:45:b6:11:af:16:51:96:86:1e:8d:7c:9f
Signer

Actual PE Digest

cf:df:80:79:67:2b:96:c9:51:c5:1d:d7:f4:2b:9c:16:a1:27:c8:35:45:b6:11:af:16:51:96:86:1e:8d:7c:9f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\x64\Release\NxdSupport.pdb

Imports

fltmgr.sys

FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltReleaseFileNameInformation
FltGetVolumeName
FltCreateFileEx
FltClose
FltIsVolumeSnapshot
FltObjectReference
FltObjectDereference
FltAllocateCallbackData
FltFreeCallbackData
FltReuseCallbackData
FltPerformSynchronousIo
FltReadFile
FltGetRoutineAddress
FltOplockFsctrl
FltCheckOplock
FltGetFileNameInformationUnsafe
FltGetVolumeGuidName

ntoskrnl.exe

DbgPrint
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeEnterGuardedRegion
KeLeaveGuardedRegion
KeBugCheckEx
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
ExConvertExclusiveToSharedLite
ExDeleteResourceLite
ExIsResourceAcquiredSharedLite
KeDelayExecutionThread
KeAreApcsDisabled
ExAllocatePoolWithTag
ExFreePoolWithTag
PsGetCurrentThreadId
RtlInitUnicodeString
RtlWriteRegistryValue
RtlUnicodeStringToAnsiString
RtlEqualUnicodeString
RtlFreeUnicodeString
RtlStringFromGUID
RtlGetVersion
MmGetSystemRoutineAddress
IoWMIRegistrationControl
ExUuidCreate
KeInitializeEvent
KeClearEvent
KeReadStateEvent
KeSetEvent
KeSetPriorityThread
KeWaitForSingleObject
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
KeQueryActiveProcessorCount
ExAcquireSpinLockShared
ExReleaseSpinLockShared
ExAcquireSpinLockExclusiveAtDpcLevel
ExAcquireSpinLockExclusive
ExReleaseSpinLockExclusiveFromDpcLevel
ExReleaseSpinLockExclusive
PsCreateSystemThread
PsTerminateSystemThread
ZwClose
KeInitializeQueue
KeInsertQueue
KeRemoveQueue
KeRundownQueue
ZwWaitForSingleObject
__C_specific_handler
RtlCopyUnicodeString
PsSetCreateThreadNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
ObOpenObjectByPointer
PsProcessType
RtlIntegerToUnicodeString
RtlAppendUnicodeStringToString
IoAllocateErrorLogEntry
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoWriteErrorLogEntry
ObfDereferenceObject
ObDereferenceObjectDeferDelete
PsSetCreateProcessNotifyRoutineEx
PsGetThreadProcessId
ZwOpenProcess
RtlValidSid
RtlEqualSid
RtlLengthRequiredSid
RtlConvertSidToUnicodeString
PsLookupProcessByProcessId
PsLookupThreadByThreadId
ZwOpenProcessTokenEx
ZwOpenThreadTokenEx
ZwQueryInformationToken
PsGetProcessExitProcessCalled
ZwOpenThread
PsInitialSystemProcess
ExIsResourceAcquiredExclusiveLite
RtlPrefixUnicodeString
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
FsRtlCancellableWaitForMultipleObjects
CcWaitForCurrentLazyWriterActivity
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmIsDriverVerifying
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
RtlQueryRegistryValues
RtlIsNtDdiVersionAvailable
FsRtlIsNtstatusExpected
RtlGUIDFromString
FsRtlAreVolumeStartupApplicationsComplete
ZwQueryValueKey
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeExports
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
RtlSetDaclSecurityDescriptor
ZwOpenKey
ZwSetValueKey
ZwCreateKey

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/ntdes/arm64/nxdsupport.inf
drivers/ntdes/x64/nxdds2.cat
drivers/ntdes/x64/nxdds2.inf
drivers/ntdes/x64/nxdds2.sys
.sys windows:10 windows x64 arch:x64

c9ec52e601e85543421efa1d07746e6d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:62:f4:5c:f9:9e:58:a9:6a:89:00:00:00:00:00:62
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/04/2023, 19:16

Not After

03/04/2024, 19:16

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ba:7d:cb:f5:e7:2d:e5:b3:55:c6:06:2e:3f:f3:42:5b:e1:72:de:af:ae:2b:1f:0a:54:40:cd:f6:77:d6:be:46
Signer

Actual PE Digest

ba:7d:cb:f5:e7:2d:e5:b3:55:c6:06:2e:3f:f3:42:5b:e1:72:de:af:ae:2b:1f:0a:54:40:cd:f6:77:d6:be:46

Digest Algorithm

sha256

PE Digest Matches

true

ba:7d:cb:f5:e7:2d:e5:b3:55:c6:06:2e:3f:f3:42:5b:e1:72:de:af:ae:2b:1f:0a:54:40:cd:f6:77:d6:be:46
Signer

Actual PE Digest

ba:7d:cb:f5:e7:2d:e5:b3:55:c6:06:2e:3f:f3:42:5b:e1:72:de:af:ae:2b:1f:0a:54:40:cd:f6:77:d6:be:46

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\x64\Release\NxdDs2.pdb

Imports

fltmgr.sys

FltAllocateContext
FltSetInstanceContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetStreamContext
FltGetStreamHandleContext
FltReferenceContext
FltReleaseContext
FltSetCallbackDataDirty
FltQueryVolumeInformationFile
FltCancelFileOpen
FltFindExtraCreateParameter
FltReleaseFileNameInformation
FltParseFileNameInformation
FltCreateFile
FltClose
FltGetUpperInstance
FltObjectDereference
FltAllocateExtraCreateParameterList
FltRemoveExtraCreateParameter
FltFreeExtraCreateParameterList
FltFreeExtraCreateParameter
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltDetachVolume
FltGetDeviceObject
FltQueryInformationFile
FltFsControlFile
FltSetInformationFile
FltAllocateCallbackData
FltFreeCallbackData
FltPerformSynchronousIo
FltAllocateCallbackDataEx
FltReuseCallbackData
FltQueryVolumeInformation
FltReadFile
FltWriteFile
FltGetFileNameInformationUnsafe
FltAllocateExtraCreateParameter
FltGetEcpListFromCallbackData
FltSetEcpListIntoCallbackData
FltGetRoutineAddress
FltCreateFileEx2
FltOplockFsctrl
FltCheckOplock

ntoskrnl.exe

ExAllocatePoolWithTag
ExFreePoolWithTag
PsGetCurrentThreadId
FsRtlIsPagingFile
DbgPrint
CcGetFileObjectFromSectionPtrs
ExRaiseStatus
ExIsResourceAcquiredExclusiveLite
__C_specific_handler
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
ProbeForWrite
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
ObfDereferenceObject
ZwClose
SeTokenType
SeCreateClientSecurity
SeImpersonateClientEx
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
PsRevertToSelf
ObOpenObjectByPointer
FsRtlInsertExtraCreateParameter
IoFileObjectType
SeSinglePrivilegeCheck
SeExports
RtlInitUnicodeString
RtlGetVersion
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlEqualUnicodeString
KeDelayExecutionThread
KeAreAllApcsDisabled
IoGetCurrentProcess
ExAcquireResourceExclusiveLite
ExSetResourceOwnerPointer
ExIsResourceAcquiredSharedLite
KeExpandKernelStackAndCalloutEx
ExAcquireSharedStarveExclusive
RtlCompareMemory
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
IoAllocateIrp
IofCallDriver
IoFreeIrp
ObReferenceObjectByHandle
ZwCreateFile
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeAreApcsDisabled
ExAcquireResourceSharedLite
ExReleaseResourceForThreadLite
MmIsDriverVerifying
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
FsRtlAllocateExtraCreateParameter
FsRtlIsEcpFromUserMode
FsRtlAreVolumeStartupApplicationsComplete
FsRtlIsNtstatusExpected
RtlQueryRegistryValues
RtlIsNtDdiVersionAvailable
IoGetTransactionParameterBlock
ExReleaseResourceLite
ObfReferenceObject
IoGetLowerDeviceObject
IoGetDeviceAttachmentBaseRef
KeBugCheckEx

Sections

.text
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/ntdes/x64/nxddt2.cat
drivers/ntdes/x64/nxddt2.inf
drivers/ntdes/x64/nxddt2.sys
.sys windows:10 windows x64 arch:x64

d4aaa56737d8968585b8332f5f3d6fde

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:62:f4:5c:f9:9e:58:a9:6a:89:00:00:00:00:00:62
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/04/2023, 19:16

Not After

03/04/2024, 19:16

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:e2:1d:2e:d8:5e:e2:3d:dc:b8:a1:10:f8:08:ae:7c:54:d2:0f:51:64:9a:f2:c9:3f:b0:4e:d7:4d:17:32:cf
Signer

Actual PE Digest

7e:e2:1d:2e:d8:5e:e2:3d:dc:b8:a1:10:f8:08:ae:7c:54:d2:0f:51:64:9a:f2:c9:3f:b0:4e:d7:4d:17:32:cf

Digest Algorithm

sha256

PE Digest Matches

true

7e:e2:1d:2e:d8:5e:e2:3d:dc:b8:a1:10:f8:08:ae:7c:54:d2:0f:51:64:9a:f2:c9:3f:b0:4e:d7:4d:17:32:cf
Signer

Actual PE Digest

7e:e2:1d:2e:d8:5e:e2:3d:dc:b8:a1:10:f8:08:ae:7c:54:d2:0f:51:64:9a:f2:c9:3f:b0:4e:d7:4d:17:32:cf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\x64\Release\NxdDt2.pdb

Imports

cng.sys

BCryptDecrypt
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGetProperty

fltmgr.sys

FltAllocateExtraCreateParameterList
FltCheckOplock
FltOplockFsctrl
FltGetRoutineAddress
FltSetEcpListIntoCallbackData
FltGetVolumeGuidName
FltGetFileNameInformationUnsafe
FltGetVolumeFromInstance
FltGetRequestorProcess
FltIsVolumeSnapshot
FltGetDestinationFileNameInformation
FltPerformSynchronousIo
FltFreeCallbackData
FltAllocateContext
FltSetInstanceContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetStreamContext
FltGetStreamHandleContext
FltReferenceContext
FltReleaseContext
FltSetCallbackDataDirty
FltGetFileNameInformation
FltReleaseFileNameInformation
FltParseFileNameInformation
FltCreateFileEx2
FltWriteFile
FltSetInformationFile
FltQueryVolumeInformationFile
FltFlushBuffers
FltFsControlFile
FltReissueSynchronousIo
FltClose
FltCancelFileOpen
FltGetUpperInstance
FltAllocateExtraCreateParameter
FltInsertExtraCreateParameter
FltFindExtraCreateParameter
FltRemoveExtraCreateParameter
FltFreeExtraCreateParameterList
FltFreeExtraCreateParameter
FltGetEcpListFromCallbackData
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltAttachVolume
FltDetachVolume
FltGetFilterFromName
FltGetVolumeInstanceFromName
FltGetDiskDeviceObject
FltGetInstanceInformation
FltObjectDereference
FltQueryInformationFile
FltLoadFilter
FltAllocateCallbackData

ntoskrnl.exe

ExAllocatePoolWithTag
ExFreePoolWithTag
ExIsResourceAcquiredSharedLite
ObfDereferenceObject
PsSetCreateProcessNotifyRoutineEx
PsGetCurrentThreadId
PsLookupThreadByThreadId
PsGetThreadProcess
KeReadStateEvent
KeSetEvent
KeWaitForSingleObject
ExIsResourceAcquiredExclusiveLite
IofCompleteRequest
IoCsqInsertIrp
IoCsqRemoveNextIrp
FsRtlCancellableWaitForSingleObject
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlFreeUnicodeString
KeInitializeEvent
KeClearEvent
IoAllocateErrorLogEntry
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoWriteErrorLogEntry
IoCsqInitialize
PsGetCurrentProcessId
PsGetThreadProcessId
InitSafeBootMode
PsGetThreadId
DbgPrint
FsRtlIsPagingFile
RtlEqualUnicodeString
RtlIsNtDdiVersionAvailable
KeAreAllApcsDisabled
IoGetCurrentProcess
ZwClose
ZwCreateSection
FsRtlFreeExtraCreateParameter
FsRtlInsertExtraCreateParameter
FsRtlFindExtraCreateParameter
FsRtlRemoveExtraCreateParameter
PsInitialSystemProcess
RtlCompareMemory
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
MmMapLockedPagesSpecifyCache
ZwCreateKey
ZwOpenKey
ZwEnumerateValueKey
ZwQueryValueKey
KeEnterGuardedRegion
KeLeaveGuardedRegion
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
SeSinglePrivilegeCheck
SeExports
RtlInitUnicodeString
RtlGetVersion
MmGetSystemRoutineAddress
SeCaptureSubjectContext
SeReleaseSubjectContext
IoWMIRegistrationControl
ExUuidCreate
FsRtlGetNextExtraCreateParameter
MmProbeAndLockPages
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoFreeMdl
__C_specific_handler
RtlUpcaseUnicodeChar
TmGetTransactionId
ObQueryNameString
_stricmp
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
RtlUpperChar
RtlPrefixUnicodeString
IoVolumeDeviceToDosName
FsRtlAreNamesEqual
PsGetProcessImageFileName
IoAllocateIrp
IofCallDriver
IoFreeIrp
ObReferenceObjectByHandle
ZwCreateFile
IoFileObjectType
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeAreApcsDisabled
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceForThreadLite
ExSetResourceOwnerPointerEx
MmIsDriverVerifying
FsRtlIsNameInExpression
KdDebuggerNotPresent
KdDebuggerEnabled
RtlQueryRegistryValues
RtlGUIDFromString
FsRtlAllocateExtraCreateParameter
FsRtlIsEcpFromUserMode
FsRtlAreVolumeStartupApplicationsComplete
IoGetTransactionParameterBlock
FsRtlIsNtstatusExpected
KeBugCheckEx
RtlSetDaclSecurityDescriptor
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
ObOpenObjectByPointer
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
ZwSetValueKey

Sections

.text
Size: 153KB - Virtual size: 153KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/ntdes/x64/nxdisolate.cat
drivers/ntdes/x64/nxdisolate.inf
drivers/ntdes/x64/nxdisolate.sys
.sys windows:10 windows x64 arch:x64

822a8ef20c160880bf6f7622d7f26af0

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:62:f4:5c:f9:9e:58:a9:6a:89:00:00:00:00:00:62
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/04/2023, 19:16

Not After

03/04/2024, 19:16

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b2:f8:31:e4:bc:67:b6:6f:30:3c:5f:e4:6d:40:e7:69:0c:83:df:a8:4a:43:01:18:2e:a4:33:48:55:3c:78:2b
Signer

Actual PE Digest

b2:f8:31:e4:bc:67:b6:6f:30:3c:5f:e4:6d:40:e7:69:0c:83:df:a8:4a:43:01:18:2e:a4:33:48:55:3c:78:2b

Digest Algorithm

sha256

PE Digest Matches

true

b2:f8:31:e4:bc:67:b6:6f:30:3c:5f:e4:6d:40:e7:69:0c:83:df:a8:4a:43:01:18:2e:a4:33:48:55:3c:78:2b
Signer

Actual PE Digest

b2:f8:31:e4:bc:67:b6:6f:30:3c:5f:e4:6d:40:e7:69:0c:83:df:a8:4a:43:01:18:2e:a4:33:48:55:3c:78:2b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\x64\Release\NxdIsolate.pdb

Imports

fltmgr.sys

FltSetCallbackDataDirty
FltReleaseContext
FltQueryInformationFile
FltSetInformationFile
FltClose
FltDetachVolume
FltAllocateContext
FltSetInstanceContext
FltSetFileContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetFileContext
FltGetStreamContext
FltGetStreamHandleContext
FltFreeFileLock
FltFindExtraCreateParameter
FltParseFileNameInformation
FltCreateFileEx
FltFsControlFile
FltCancelFileOpen
FltOplockFsctrl
FltAllocateExtraCreateParameterList
FltRemoveExtraCreateParameter
FltGetNextExtraCreateParameter
FltReleaseFileNameInformation
FltFreeExtraCreateParameterList
FltGetEcpListFromCallbackData
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltGetDeviceObject
FltGetDiskDeviceObject
FltIsVolumeWritable
FltIsVolumeSnapshot
FltQueryVolumeInformation
FltCompletePendedPreOperation
FltIsIoCanceled
FltIs32bitProcess
FltCompletePendedPostOperation
FltAllocateCallbackData
FltFreeCallbackData
FltReuseCallbackData
FltPerformSynchronousIo
FltAllocateFileLock
FltProcessFileLock
FltGetRequestorProcess
FltCheckAndGrowNameControl
FltGetFileNameInformation
FltGetFileNameInformationUnsafe
FltQueryDirectoryFile
FltCheckOplock
FltOplockIsFastIoPossible
FltOplockBreakH
FltOplockIsSharedRequest
FltReissueSynchronousIo
FltCheckLockForReadAccess
FltIsOperationSynchronous
FltGetDestinationFileNameInformation
FltWriteFile
FltGetVolumeFromInstance
FltGetTopInstance
FltObjectDereference
FltCheckLockForWriteAccess
FltGetRoutineAddress
FltCreateFileEx2

ntoskrnl.exe

RtlIsNtDdiVersionAvailable
KeInitializeEvent
KeSetEvent
KeDelayExecutionThread
KeEnterGuardedRegion
KeLeaveGuardedRegion
KeWaitForSingleObject
ExAcquireFastMutex
ExReleaseFastMutex
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
ExIsResourceAcquiredExclusiveLite
ExIsResourceAcquiredSharedLite
MmGetSystemRoutineAddress
IoGetStackLimits
IoWithinStackLimits
ObfReferenceObject
ObfDereferenceObject
ObDereferenceObjectDeferDelete
PsGetCurrentThreadId
PsIsSystemThread
MmCanFileBeTruncated
FsRtlIsNtstatusExpected
FsRtlChangeBackingFileObject
CcInitializeCacheMap
CcUninitializeCacheMap
CcPurgeCacheSection
CcFlushCache
CcGetFileObjectFromSectionPtrsRef
CcSetReadAheadGranularity
CcSetAdditionalCacheAttributes
__C_specific_handler
RtlFreeUnicodeString
RtlStringFromGUID
ExAllocatePoolWithTag
ExFreePoolWithTag
ExGetPreviousMode
ExUuidCreate
CcSetFileSizes
ExInitializeResourceLite
ExDeleteResourceLite
FsRtlUninitializeOplock
FsRtlTeardownPerFileContexts
FsRtlTeardownPerStreamContexts
FsRtlInsertPerFileObjectContext
FsRtlLookupPerFileObjectContext
FsRtlRemovePerFileObjectContext
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
MmDoesFileHaveUserWritableReferences
KeExpandKernelStackAndCalloutEx
IoIsFileObjectIgnoringSharing
FsRtlCurrentBatchOplock
FsRtlInsertExtraCreateParameter
RtlEqualUnicodeString
SeTokenType
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
FsRtlDissectName
RtlCompareUnicodeString
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
RtlLookupFirstMatchingElementGenericTableAvl
RtlGetElementGenericTableAvl
RtlNumberGenericTableElementsAvl
RtlIsGenericTableEmptyAvl
IoGetCurrentProcess
ObReferenceObjectByHandle
SeSinglePrivilegeCheck
NtClose
KeStackAttachProcess
KeUnstackDetachProcess
IoAcquireVpbSpinLock
IoReleaseVpbSpinLock
ObOpenObjectByPointer
IoFileObjectType
SeExports
RtlInitUnicodeString
RtlGetVersion
IoWMIRegistrationControl
PsGetCurrentProcessId
FsRtlGetNextFileLock
FsRtlFastUnlockSingle
FsRtlFastUnlockAll
FsRtlFastUnlockAllByKey
FsRtlPrivateLock
KeAreApcsDisabled
KeAreAllApcsDisabled
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExSetResourceOwnerPointerEx
MmFlushImageSection
CcZeroData
MmForceSectionClosed
ExRaiseStatus
IoGetTopLevelIrp
SeCreateClientSecurity
SeImpersonateClientEx
PsRevertToSelf
FsRtlInitializeOplock
FsRtlOplockKeysEqual
FsRtlIsPagingFile
MmMapLockedPagesSpecifyCache
FsRtlMdlReadCompleteDev
CcCopyRead
CcMdlRead
ExReleaseResourceForThreadLite
FsRtlCurrentOplockH
RtlCompareMemory
RtlCaptureStackBackTrace
FsRtlCancellableWaitForSingleObject
CcSetFileSizesEx
MmProbeAndLockPages
IoAllocateMdl
IoFreeMdl
PsGetThreadProcessId
FsRtlMdlWriteCompleteDev
FsRtlFastCheckLockForRead
FsRtlFastCheckLockForWrite
CcCanIWrite
CcDeferWrite
CcCopyWrite
CcPrepareMdlWrite
IoAllocateIrp
IofCallDriver
IoFreeIrp
ZwCreateFile
ZwClose
DbgPrint
KeEnterCriticalRegion
KeLeaveCriticalRegion
MmIsDriverVerifying
FsRtlIsNameInExpression
KdDebuggerNotPresent
KdDebuggerEnabled
IoGetLowerDeviceObject
IoGetDeviceAttachmentBaseRef
IoGetTransactionParameterBlock
RtlQueryRegistryValues
KeBugCheckEx

Sections

.text
Size: 268KB - Virtual size: 267KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/ntdes/x64/nxdsupport.cat
drivers/ntdes/x64/nxdsupport.inf
drivers/ntdes/x64/nxdsupport.sys
.sys windows:10 windows x64 arch:x64

18fa52f66b992df95c74c3e25e408fdb

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:62:f4:5c:f9:9e:58:a9:6a:89:00:00:00:00:00:62
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/04/2023, 19:16

Not After

03/04/2024, 19:16

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:df:80:79:67:2b:96:c9:51:c5:1d:d7:f4:2b:9c:16:a1:27:c8:35:45:b6:11:af:16:51:96:86:1e:8d:7c:9f
Signer

Actual PE Digest

cf:df:80:79:67:2b:96:c9:51:c5:1d:d7:f4:2b:9c:16:a1:27:c8:35:45:b6:11:af:16:51:96:86:1e:8d:7c:9f

Digest Algorithm

sha256

PE Digest Matches

true

cf:df:80:79:67:2b:96:c9:51:c5:1d:d7:f4:2b:9c:16:a1:27:c8:35:45:b6:11:af:16:51:96:86:1e:8d:7c:9f
Signer

Actual PE Digest

cf:df:80:79:67:2b:96:c9:51:c5:1d:d7:f4:2b:9c:16:a1:27:c8:35:45:b6:11:af:16:51:96:86:1e:8d:7c:9f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\x64\Release\NxdSupport.pdb

Imports

fltmgr.sys

FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltReleaseFileNameInformation
FltGetVolumeName
FltCreateFileEx
FltClose
FltIsVolumeSnapshot
FltObjectReference
FltObjectDereference
FltAllocateCallbackData
FltFreeCallbackData
FltReuseCallbackData
FltPerformSynchronousIo
FltReadFile
FltGetRoutineAddress
FltOplockFsctrl
FltCheckOplock
FltGetFileNameInformationUnsafe
FltGetVolumeGuidName

ntoskrnl.exe

DbgPrint
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeEnterGuardedRegion
KeLeaveGuardedRegion
KeBugCheckEx
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
ExConvertExclusiveToSharedLite
ExDeleteResourceLite
ExIsResourceAcquiredSharedLite
KeDelayExecutionThread
KeAreApcsDisabled
ExAllocatePoolWithTag
ExFreePoolWithTag
PsGetCurrentThreadId
RtlInitUnicodeString
RtlWriteRegistryValue
RtlUnicodeStringToAnsiString
RtlEqualUnicodeString
RtlFreeUnicodeString
RtlStringFromGUID
RtlGetVersion
MmGetSystemRoutineAddress
IoWMIRegistrationControl
ExUuidCreate
KeInitializeEvent
KeClearEvent
KeReadStateEvent
KeSetEvent
KeSetPriorityThread
KeWaitForSingleObject
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
KeQueryActiveProcessorCount
ExAcquireSpinLockShared
ExReleaseSpinLockShared
ExAcquireSpinLockExclusiveAtDpcLevel
ExAcquireSpinLockExclusive
ExReleaseSpinLockExclusiveFromDpcLevel
ExReleaseSpinLockExclusive
PsCreateSystemThread
PsTerminateSystemThread
ZwClose
KeInitializeQueue
KeInsertQueue
KeRemoveQueue
KeRundownQueue
ZwWaitForSingleObject
__C_specific_handler
RtlCopyUnicodeString
PsSetCreateThreadNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
ObOpenObjectByPointer
PsProcessType
RtlIntegerToUnicodeString
RtlAppendUnicodeStringToString
IoAllocateErrorLogEntry
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoWriteErrorLogEntry
ObfDereferenceObject
ObDereferenceObjectDeferDelete
PsSetCreateProcessNotifyRoutineEx
PsGetThreadProcessId
ZwOpenProcess
RtlValidSid
RtlEqualSid
RtlLengthRequiredSid
RtlConvertSidToUnicodeString
PsLookupProcessByProcessId
PsLookupThreadByThreadId
ZwOpenProcessTokenEx
ZwOpenThreadTokenEx
ZwQueryInformationToken
PsGetProcessExitProcessCalled
ZwOpenThread
PsInitialSystemProcess
ExIsResourceAcquiredExclusiveLite
RtlPrefixUnicodeString
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
FsRtlCancellableWaitForMultipleObjects
CcWaitForCurrentLazyWriterActivity
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmIsDriverVerifying
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
RtlQueryRegistryValues
RtlIsNtDdiVersionAvailable
FsRtlIsNtstatusExpected
RtlGUIDFromString
FsRtlAreVolumeStartupApplicationsComplete
ZwQueryValueKey
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeExports
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
RtlSetDaclSecurityDescriptor
ZwOpenKey
ZwSetValueKey
ZwCreateKey

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/ntdes/x86/nxdds2.cat
drivers/ntdes/x86/nxdds2.inf
drivers/ntdes/x86/nxdds2.sys
.sys windows:10 windows x86 arch:x86

18470b669f23772a7423816aae553f7c

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:62:f4:5c:f9:9e:58:a9:6a:89:00:00:00:00:00:62
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/04/2023, 19:16

Not After

03/04/2024, 19:16

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ba:0c:bd:48:e2:e7:a4:8e:d8:c3:d4:37:95:39:a0:be:17:22:8a:a9:35:9b:b1:93:f9:32:e8:60:4f:0f:3e:82
Signer

Actual PE Digest

ba:0c:bd:48:e2:e7:a4:8e:d8:c3:d4:37:95:39:a0:be:17:22:8a:a9:35:9b:b1:93:f9:32:e8:60:4f:0f:3e:82

Digest Algorithm

sha256

PE Digest Matches

true

ba:0c:bd:48:e2:e7:a4:8e:d8:c3:d4:37:95:39:a0:be:17:22:8a:a9:35:9b:b1:93:f9:32:e8:60:4f:0f:3e:82
Signer

Actual PE Digest

ba:0c:bd:48:e2:e7:a4:8e:d8:c3:d4:37:95:39:a0:be:17:22:8a:a9:35:9b:b1:93:f9:32:e8:60:4f:0f:3e:82

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\Release\NxdDs2.pdb

Imports

fltmgr.sys

FltAllocateContext
FltSetInstanceContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetStreamContext
FltGetStreamHandleContext
FltReferenceContext
FltReleaseContext
FltSetCallbackDataDirty
FltQueryVolumeInformationFile
FltCancelFileOpen
FltFindExtraCreateParameter
FltReleaseFileNameInformation
FltParseFileNameInformation
FltCreateFile
FltClose
FltGetUpperInstance
FltObjectDereference
FltAllocateExtraCreateParameterList
FltRemoveExtraCreateParameter
FltFreeExtraCreateParameterList
FltFreeExtraCreateParameter
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltDetachVolume
FltGetDeviceObject
FltQueryInformationFile
FltFsControlFile
FltSetInformationFile
FltAllocateCallbackData
FltFreeCallbackData
FltPerformSynchronousIo
FltAllocateCallbackDataEx
FltReuseCallbackData
FltQueryVolumeInformation
FltReadFile
FltWriteFile
FltGetFileNameInformationUnsafe
FltAllocateExtraCreateParameter
FltGetEcpListFromCallbackData
FltSetEcpListIntoCallbackData
FltGetRoutineAddress
FltCreateFileEx2
FltOplockFsctrl
FltCheckOplock

ntoskrnl.exe

PsGetCurrentThreadId
FsRtlIsPagingFile
memset
DbgPrint
CcGetFileObjectFromSectionPtrs
ExRaiseStatus
ExIsResourceAcquiredExclusiveLite
memcpy
KeGetCurrentThread
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
ProbeForWrite
MmProbeAndLockPages
ExFreePoolWithTag
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
ObfDereferenceObject
ZwClose
SeTokenType
SeCreateClientSecurity
SeImpersonateClientEx
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
PsRevertToSelf
ObOpenObjectByPointer
FsRtlInsertExtraCreateParameter
IoFileObjectType
SeSinglePrivilegeCheck
SeExports
RtlInitUnicodeString
RtlGetVersion
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlEqualUnicodeString
KeDelayExecutionThread
KeAreAllApcsDisabled
IoGetCurrentProcess
ExAcquireResourceExclusiveLite
ExSetResourceOwnerPointer
ExIsResourceAcquiredSharedLite
KeExpandKernelStackAndCalloutEx
ExAcquireSharedStarveExclusive
RtlCompareMemory
_aullrem
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
IoAllocateIrp
IofCallDriver
IoFreeIrp
ObReferenceObjectByHandle
ZwCreateFile
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeAreApcsDisabled
ExAcquireResourceSharedLite
ExReleaseResourceForThreadLite
MmIsDriverVerifying
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
FsRtlAllocateExtraCreateParameter
FsRtlIsEcpFromUserMode
FsRtlAreVolumeStartupApplicationsComplete
FsRtlIsNtstatusExpected
RtlQueryRegistryValues
RtlIsNtDdiVersionAvailable
IoGetTransactionParameterBlock
ExReleaseResourceLite
ObfReferenceObject
IoGetLowerDeviceObject
IoGetDeviceAttachmentBaseRef
KeBugCheckEx
ExAllocatePoolWithTag
RtlUnwind
MmUnlockPages

hal

KeGetCurrentIrql

Sections

.text
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/ntdes/x86/nxddt2.cat
drivers/ntdes/x86/nxddt2.inf
drivers/ntdes/x86/nxddt2.sys
.sys windows:10 windows x86 arch:x86

1216db4b536fdd5d00af68ef963c4e96

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:62:f4:5c:f9:9e:58:a9:6a:89:00:00:00:00:00:62
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/04/2023, 19:16

Not After

03/04/2024, 19:16

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4a:b2:b6:04:bd:14:75:b2:82:a0:c0:68:82:41:04:b4:38:c1:65:eb:cc:c9:6b:04:63:d8:e7:5a:59:a8:89:aa
Signer

Actual PE Digest

4a:b2:b6:04:bd:14:75:b2:82:a0:c0:68:82:41:04:b4:38:c1:65:eb:cc:c9:6b:04:63:d8:e7:5a:59:a8:89:aa

Digest Algorithm

sha256

PE Digest Matches

true

4a:b2:b6:04:bd:14:75:b2:82:a0:c0:68:82:41:04:b4:38:c1:65:eb:cc:c9:6b:04:63:d8:e7:5a:59:a8:89:aa
Signer

Actual PE Digest

4a:b2:b6:04:bd:14:75:b2:82:a0:c0:68:82:41:04:b4:38:c1:65:eb:cc:c9:6b:04:63:d8:e7:5a:59:a8:89:aa

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\Release\NxdDt2.pdb

Imports

cng.sys

BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDestroyKey
BCryptDecrypt
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGetProperty
BCryptDestroyHash
BCryptOpenAlgorithmProvider

fltmgr.sys

FltInsertExtraCreateParameter
FltIsVolumeSnapshot
FltGetDestinationFileNameInformation
FltPerformSynchronousIo
FltFreeCallbackData
FltCheckOplock
FltOplockFsctrl
FltGetRoutineAddress
FltSetEcpListIntoCallbackData
FltGetVolumeGuidName
FltGetFileNameInformationUnsafe
FltGetVolumeFromInstance
FltAllocateCallbackData
FltAllocateContext
FltSetInstanceContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetStreamContext
FltGetStreamHandleContext
FltReferenceContext
FltReleaseContext
FltSetCallbackDataDirty
FltGetFileNameInformation
FltReleaseFileNameInformation
FltParseFileNameInformation
FltCreateFileEx2
FltWriteFile
FltSetInformationFile
FltQueryVolumeInformationFile
FltFlushBuffers
FltFsControlFile
FltReissueSynchronousIo
FltClose
FltCancelFileOpen
FltAllocateExtraCreateParameterList
FltAllocateExtraCreateParameter
FltGetUpperInstance
FltFindExtraCreateParameter
FltRemoveExtraCreateParameter
FltFreeExtraCreateParameterList
FltFreeExtraCreateParameter
FltGetEcpListFromCallbackData
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltAttachVolume
FltDetachVolume
FltGetFilterFromName
FltGetVolumeInstanceFromName
FltGetDiskDeviceObject
FltGetInstanceInformation
FltObjectDereference
FltQueryInformationFile
FltLoadFilter
FltGetRequestorProcess

ntoskrnl.exe

PsLookupThreadByThreadId
PsGetThreadProcess
memset
KeReadStateEvent
KeSetEvent
KeWaitForSingleObject
ExIsResourceAcquiredExclusiveLite
IofCompleteRequest
IoCsqInsertIrp
IoCsqRemoveNextIrp
FsRtlCancellableWaitForSingleObject
memcpy
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlFreeUnicodeString
PsSetCreateProcessNotifyRoutineEx
KeClearEvent
IoAllocateErrorLogEntry
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoWriteErrorLogEntry
IoCsqInitialize
PsGetCurrentProcessId
PsGetThreadProcessId
InitSafeBootMode
PsGetThreadId
DbgPrint
FsRtlIsPagingFile
RtlEqualUnicodeString
RtlIsNtDdiVersionAvailable
KeAreAllApcsDisabled
IoGetCurrentProcess
ZwClose
ZwCreateSection
FsRtlFreeExtraCreateParameter
FsRtlInsertExtraCreateParameter
FsRtlFindExtraCreateParameter
FsRtlRemoveExtraCreateParameter
PsInitialSystemProcess
RtlCompareMemory
MmMapLockedPagesSpecifyCache
ZwCreateKey
ZwOpenKey
ZwEnumerateValueKey
ZwQueryValueKey
KeEnterGuardedRegion
KeLeaveGuardedRegion
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
SeSinglePrivilegeCheck
SeExports
RtlInitUnicodeString
RtlGetVersion
MmGetSystemRoutineAddress
SeCaptureSubjectContext
SeReleaseSubjectContext
IoWMIRegistrationControl
ExUuidCreate
FsRtlGetNextExtraCreateParameter
MmProbeAndLockPages
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoFreeMdl
RtlUpcaseUnicodeChar
TmGetTransactionId
ObQueryNameString
_stricmp
RtlUpperChar
RtlPrefixUnicodeString
IoVolumeDeviceToDosName
FsRtlAreNamesEqual
PsGetProcessImageFileName
KeGetCurrentThread
IoAllocateIrp
IofCallDriver
IoFreeIrp
ObReferenceObjectByHandle
ZwCreateFile
IoFileObjectType
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeAreApcsDisabled
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceForThreadLite
ExSetResourceOwnerPointerEx
MmIsDriverVerifying
FsRtlIsNameInExpression
KdDebuggerNotPresent
KdDebuggerEnabled
RtlQueryRegistryValues
RtlGUIDFromString
FsRtlAllocateExtraCreateParameter
FsRtlIsEcpFromUserMode
FsRtlAreVolumeStartupApplicationsComplete
memmove
IoGetTransactionParameterBlock
FsRtlIsNtstatusExpected
KeBugCheckEx
RtlSetDaclSecurityDescriptor
RtlUnwind
ObfDereferenceObject
ExIsResourceAcquiredSharedLite
ExFreePoolWithTag
ExAllocatePoolWithTag
PsGetCurrentThreadId
KeInitializeEvent
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
ObOpenObjectByPointer
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
ZwSetValueKey

hal

KfAcquireSpinLock
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
KfReleaseSpinLock
KeGetCurrentIrql

Sections

.text
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/ntdes/x86/nxdisolate.cat
drivers/ntdes/x86/nxdisolate.inf
drivers/ntdes/x86/nxdisolate.sys
.sys windows:10 windows x86 arch:x86

92d4d0dc9a0ca6b63f06a872f186d28b

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:62:f4:5c:f9:9e:58:a9:6a:89:00:00:00:00:00:62
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/04/2023, 19:16

Not After

03/04/2024, 19:16

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:16:fd:a4:d7:86:86:e5:f7:06:f5:aa:f8:ef:b0:0c:74:c9:56:d4:16:80:b1:08:7a:00:7f:f4:0f:f7:bc:1a
Signer

Actual PE Digest

39:16:fd:a4:d7:86:86:e5:f7:06:f5:aa:f8:ef:b0:0c:74:c9:56:d4:16:80:b1:08:7a:00:7f:f4:0f:f7:bc:1a

Digest Algorithm

sha256

PE Digest Matches

true

39:16:fd:a4:d7:86:86:e5:f7:06:f5:aa:f8:ef:b0:0c:74:c9:56:d4:16:80:b1:08:7a:00:7f:f4:0f:f7:bc:1a
Signer

Actual PE Digest

39:16:fd:a4:d7:86:86:e5:f7:06:f5:aa:f8:ef:b0:0c:74:c9:56:d4:16:80:b1:08:7a:00:7f:f4:0f:f7:bc:1a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\Release\NxdIsolate.pdb

Imports

fltmgr.sys

FltSetCallbackDataDirty
FltReleaseContext
FltQueryInformationFile
FltSetInformationFile
FltClose
FltDetachVolume
FltAllocateContext
FltSetInstanceContext
FltSetFileContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetFileContext
FltGetStreamContext
FltGetStreamHandleContext
FltFreeFileLock
FltFindExtraCreateParameter
FltParseFileNameInformation
FltCreateFileEx
FltFsControlFile
FltCancelFileOpen
FltOplockFsctrl
FltAllocateExtraCreateParameterList
FltRemoveExtraCreateParameter
FltGetNextExtraCreateParameter
FltReleaseFileNameInformation
FltFreeExtraCreateParameterList
FltGetEcpListFromCallbackData
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltGetDeviceObject
FltGetDiskDeviceObject
FltIsVolumeWritable
FltIsVolumeSnapshot
FltQueryVolumeInformation
FltCompletePendedPreOperation
FltIsIoCanceled
FltCompletePendedPostOperation
FltAllocateCallbackData
FltFreeCallbackData
FltReuseCallbackData
FltPerformSynchronousIo
FltAllocateFileLock
FltProcessFileLock
FltGetRequestorProcess
FltCheckAndGrowNameControl
FltGetFileNameInformation
FltGetFileNameInformationUnsafe
FltQueryDirectoryFile
FltCheckOplock
FltOplockIsFastIoPossible
FltOplockBreakH
FltOplockIsSharedRequest
FltReissueSynchronousIo
FltCheckLockForReadAccess
FltIsOperationSynchronous
FltGetDestinationFileNameInformation
FltWriteFile
FltGetVolumeFromInstance
FltGetTopInstance
FltObjectDereference
FltCheckLockForWriteAccess
FltGetRoutineAddress
FltCreateFileEx2

ntoskrnl.exe

KeDelayExecutionThread
KeEnterGuardedRegion
KeLeaveGuardedRegion
KeWaitForSingleObject
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
ExIsResourceAcquiredExclusiveLite
ExIsResourceAcquiredSharedLite
MmGetSystemRoutineAddress
IoGetStackLimits
IoWithinStackLimits
ObfReferenceObject
ObfDereferenceObject
ObDereferenceObjectDeferDelete
PsGetCurrentThreadId
PsIsSystemThread
MmCanFileBeTruncated
FsRtlIsNtstatusExpected
FsRtlChangeBackingFileObject
CcInitializeCacheMap
CcUninitializeCacheMap
CcPurgeCacheSection
CcFlushCache
CcGetFileObjectFromSectionPtrsRef
CcSetReadAheadGranularity
CcSetAdditionalCacheAttributes
memset
RtlFreeUnicodeString
RtlStringFromGUID
KeQuerySystemTime
ExAllocatePoolWithTag
ExFreePoolWithTag
ExGetPreviousMode
ExUuidCreate
CcSetFileSizes
memcpy
ExInitializeResourceLite
ExDeleteResourceLite
KeSetEvent
FsRtlTeardownPerFileContexts
FsRtlTeardownPerStreamContexts
FsRtlInsertPerFileObjectContext
FsRtlLookupPerFileObjectContext
FsRtlRemovePerFileObjectContext
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
MmDoesFileHaveUserWritableReferences
KeExpandKernelStackAndCalloutEx
IoIsFileObjectIgnoringSharing
FsRtlCurrentBatchOplock
FsRtlInsertExtraCreateParameter
RtlEqualUnicodeString
SeTokenType
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
FsRtlDissectName
RtlCompareUnicodeString
RtlInitializeGenericTableAvl
RtlInsertElementGenericTableAvl
RtlDeleteElementGenericTableAvl
RtlLookupElementGenericTableAvl
RtlEnumerateGenericTableWithoutSplayingAvl
RtlLookupFirstMatchingElementGenericTableAvl
RtlGetElementGenericTableAvl
RtlNumberGenericTableElementsAvl
RtlIsGenericTableEmptyAvl
IoGetCurrentProcess
ObReferenceObjectByHandle
SeSinglePrivilegeCheck
NtClose
KeStackAttachProcess
KeUnstackDetachProcess
IoAcquireVpbSpinLock
IoReleaseVpbSpinLock
ObOpenObjectByPointer
IoFileObjectType
SeExports
RtlInitUnicodeString
RtlGetVersion
IoWMIRegistrationControl
PsGetCurrentProcessId
FsRtlGetNextFileLock
FsRtlFastUnlockSingle
FsRtlFastUnlockAll
FsRtlFastUnlockAllByKey
FsRtlPrivateLock
KeAreApcsDisabled
KeAreAllApcsDisabled
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExSetResourceOwnerPointerEx
MmFlushImageSection
CcZeroData
MmForceSectionClosed
ExRaiseStatus
IoGetTopLevelIrp
SeCreateClientSecurity
SeImpersonateClientEx
PsRevertToSelf
FsRtlInitializeOplock
FsRtlOplockKeysEqual
FsRtlIsPagingFile
MmMapLockedPagesSpecifyCache
FsRtlMdlReadCompleteDev
CcCopyRead
CcMdlRead
ExReleaseResourceForThreadLite
FsRtlCurrentOplockH
RtlCompareMemory
RtlCaptureStackBackTrace
FsRtlCancellableWaitForSingleObject
CcSetFileSizesEx
MmProbeAndLockPages
IoAllocateMdl
IoFreeMdl
PsGetThreadProcessId
FsRtlMdlWriteCompleteDev
FsRtlFastCheckLockForRead
FsRtlFastCheckLockForWrite
CcCanIWrite
CcDeferWrite
CcCopyWrite
CcPrepareMdlWrite
IoAllocateIrp
IofCallDriver
IoFreeIrp
ZwCreateFile
ZwClose
DbgPrint
KeEnterCriticalRegion
KeLeaveCriticalRegion
MmIsDriverVerifying
FsRtlIsNameInExpression
KdDebuggerNotPresent
KdDebuggerEnabled
IoGetLowerDeviceObject
IoGetDeviceAttachmentBaseRef
IoGetTransactionParameterBlock
RtlQueryRegistryValues
KeBugCheckEx
KeGetCurrentThread
RtlUnwind
KeInitializeEvent
RtlIsNtDdiVersionAvailable
FsRtlUninitializeOplock

hal

ExReleaseFastMutex
ExAcquireFastMutex
KeGetCurrentIrql

Sections

.text
Size: 215KB - Virtual size: 214KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/ntdes/x86/nxdsupport.cat
drivers/ntdes/x86/nxdsupport.inf
drivers/ntdes/x86/nxdsupport.sys
.sys windows:10 windows x86 arch:x86

923fa89055fa581e9feaa737a5eaa8b7

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:62:f4:5c:f9:9e:58:a9:6a:89:00:00:00:00:00:62
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/04/2023, 19:16

Not After

03/04/2024, 19:16

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:c1:d5:3c:56:b6:87:39:c2:8c:7c:d5:2f:52:de:b8:d0:86:7e:92:86:ab:5e:35:e0:78:f5:83:fb:22:a8:c6
Signer

Actual PE Digest

30:c1:d5:3c:56:b6:87:39:c2:8c:7c:d5:2f:52:de:b8:d0:86:7e:92:86:ab:5e:35:e0:78:f5:83:fb:22:a8:c6

Digest Algorithm

sha256

PE Digest Matches

true

30:c1:d5:3c:56:b6:87:39:c2:8c:7c:d5:2f:52:de:b8:d0:86:7e:92:86:ab:5e:35:e0:78:f5:83:fb:22:a8:c6
Signer

Actual PE Digest

30:c1:d5:3c:56:b6:87:39:c2:8c:7c:d5:2f:52:de:b8:d0:86:7e:92:86:ab:5e:35:e0:78:f5:83:fb:22:a8:c6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\Release\NxdSupport.pdb

Imports

fltmgr.sys

FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltReleaseFileNameInformation
FltGetVolumeName
FltCreateFileEx
FltClose
FltIsVolumeSnapshot
FltObjectReference
FltObjectDereference
FltAllocateCallbackData
FltFreeCallbackData
FltReuseCallbackData
FltPerformSynchronousIo
FltReadFile
FltGetRoutineAddress
FltOplockFsctrl
FltCheckOplock
FltGetFileNameInformationUnsafe
FltGetVolumeGuidName

ntoskrnl.exe

KeBugCheckEx
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
ExConvertExclusiveToSharedLite
ExDeleteResourceLite
ExIsResourceAcquiredSharedLite
memset
KeDelayExecutionThread
KeAreApcsDisabled
ExAllocatePoolWithTag
ExFreePoolWithTag
PsGetCurrentThreadId
RtlInitUnicodeString
RtlWriteRegistryValue
RtlUnicodeStringToAnsiString
RtlEqualUnicodeString
RtlFreeUnicodeString
RtlStringFromGUID
RtlGetVersion
MmGetSystemRoutineAddress
IoWMIRegistrationControl
ExUuidCreate
memcpy
KeInitializeEvent
KeClearEvent
KeReadStateEvent
KeSetEvent
KeSetPriorityThread
KeWaitForSingleObject
KeQuerySystemTime
KeQueryActiveProcessorCount
ExAcquireSpinLockShared
ExReleaseSpinLockShared
ExAcquireSpinLockExclusiveAtDpcLevel
ExAcquireSpinLockExclusive
ExReleaseSpinLockExclusiveFromDpcLevel
ExReleaseSpinLockExclusive
PsCreateSystemThread
PsTerminateSystemThread
ZwClose
KeInitializeQueue
KeInsertQueue
KeRemoveQueue
KeRundownQueue
ZwWaitForSingleObject
_alldiv
_aulldiv
RtlCopyUnicodeString
PsSetCreateThreadNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
ObOpenObjectByPointer
KeLeaveGuardedRegion
RtlIntegerToUnicodeString
RtlAppendUnicodeStringToString
IoAllocateErrorLogEntry
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoWriteErrorLogEntry
ObfDereferenceObject
ObDereferenceObjectDeferDelete
PsSetCreateProcessNotifyRoutineEx
PsGetThreadProcessId
ZwOpenProcess
RtlValidSid
RtlEqualSid
RtlLengthRequiredSid
RtlConvertSidToUnicodeString
PsLookupProcessByProcessId
PsLookupThreadByThreadId
ZwOpenProcessTokenEx
ZwOpenThreadTokenEx
ZwQueryInformationToken
PsGetProcessExitProcessCalled
ZwOpenThread
PsInitialSystemProcess
ExIsResourceAcquiredExclusiveLite
RtlPrefixUnicodeString
memmove
FsRtlCancellableWaitForMultipleObjects
CcWaitForCurrentLazyWriterActivity
_allmul
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmIsDriverVerifying
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
RtlQueryRegistryValues
RtlIsNtDdiVersionAvailable
FsRtlIsNtstatusExpected
RtlGUIDFromString
FsRtlAreVolumeStartupApplicationsComplete
KeGetCurrentThread
RtlUnwind
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeExports
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
RtlSetDaclSecurityDescriptor
ZwOpenKey
ZwSetValueKey
ZwQueryValueKey
ZwCreateKey
KeEnterGuardedRegion
KeLeaveCriticalRegion
KeEnterCriticalRegion
DbgPrint
PsProcessType

hal

KfAcquireSpinLock
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
KeGetCurrentIrql
KfReleaseSpinLock

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/winpcap/npf.sys
.sys windows:6 windows x86 arch:x86

5d756b1deabd7b6ee3f068c3a075da59

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

14:02:ae:ef:0d:31:be:74:3e:73:f6:a7:a9:60:c4:f4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26/09/2012, 00:00

Not After

27/10/2015, 23:59

Subject

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:e7:0a:3a:44:82:c0:ba:77:ec:38:6d:cb:57:06:95:ab:5f:c3:71
Signer

Actual PE Digest

67:e7:0a:3a:44:82:c0:ba:77:ec:38:6d:cb:57:06:95:ab:5f:c3:71

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

c:\releases\winpcap_4_1_3\winpcap\packetntx\driver\bin\i386\npf.pdb

Imports

ntoskrnl.exe

MmProbeAndLockPages
IoAllocateMdl
KeResetEvent
ObfDereferenceObject
ObReferenceObjectByHandle
ExEventObjectType
IofCompleteRequest
_allmul
PsGetVersion
KeQuerySystemTime
_allrem
_alldiv
KeWaitForSingleObject
KeInitializeEvent
_aullrem
_aulldiv
ZwSetInformationThread
KeSetEvent
IoFreeMdl
KeClearEvent
KefReleaseSpinLockFromDpcLevel
MmBuildMdlForNonPagedPool
KefAcquireSpinLockAtDpcLevel
KeTickCount
KeBugCheckEx
MmUnlockPages
ExfInterlockedRemoveHeadList
ExfInterlockedInsertTailList
IoDeleteSymbolicLink
IoDeleteDevice
RtlCompareMemory
RtlAppendUnicodeStringToString
RtlAppendUnicodeToString
IoCreateDevice
IoCreateSymbolicLink
ZwOpenKey
ZwEnumerateKey
RtlInitUnicodeString
ZwQueryValueKey
ZwClose
memcpy
memset
ExAllocatePoolWithTag
RtlQueryRegistryValues
RtlWriteRegistryValue
MmMapLockedPagesSpecifyCache
ExFreePoolWithTag
RtlUnwind

hal

KfReleaseSpinLock
KeQueryPerformanceCounter
KfLowerIrql
KfRaiseIrql
KfAcquireSpinLock

ndis.sys

NdisInitializeEvent
NdisCloseAdapter
NdisSystemProcessorCount
NdisRegisterProtocol
NdisFreePacketPool
NdisRequest
NdisWaitEvent
NdisSetEvent
NdisDeregisterProtocol
NdisOpenAdapter
NdisAllocatePacketPool
NdisFreePacket
NdisAllocatePacket
NdisResetEvent
NdisUnchainBufferAtFront

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drivers/winpcap/npf64.sys
.sys windows:6 windows x64 arch:x64

7973a97ee6904fb821131de309da29bf

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

14:02:ae:ef:0d:31:be:74:3e:73:f6:a7:a9:60:c4:f4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26/09/2012, 00:00

Not After

27/10/2015, 23:59

Subject

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

d6:c1:22:65:99:98:4d:56:8b:84:2f:9d:e1:99:78:1c:8d:c4:0f:60
Signer

Actual PE Digest

d6:c1:22:65:99:98:4d:56:8b:84:2f:9d:e1:99:78:1c:8d:c4:0f:60

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\releases\winpcap_4_1_3\winpcap\packetntx\driver\bin\amd64\npf.pdb

Imports

ntoskrnl.exe

RtlWriteRegistryValue
MmProbeAndLockPages
PsGetVersion
ExInterlockedRemoveHeadList
RtlCompareMemory
MmUnlockPages
IoCreateSymbolicLink
ObfDereferenceObject
IoCreateDevice
ZwEnumerateKey
IoAllocateMdl
ZwOpenKey
KeAcquireSpinLockRaiseToDpc
KeSetEvent
ZwSetInformationThread
KeClearEvent
ObReferenceObjectByHandle
KeReleaseSpinLockFromDpcLevel
MmMapLockedPagesSpecifyCache
KeWaitForSingleObject
KeAcquireSpinLockAtDpcLevel
KeBugCheckEx
IofCompleteRequest
RtlAppendUnicodeStringToString
ZwClose
ExEventObjectType
ExInterlockedInsertTailList
ZwQueryValueKey
IoFreeMdl
KeReleaseSpinLock
IoIs32bitProcess
RtlQueryRegistryValues
RtlAppendUnicodeToString
IoDeleteDevice
RtlInitUnicodeString
KeResetEvent
ExFreePoolWithTag
IoDeleteSymbolicLink
MmBuildMdlForNonPagedPool
ExAllocatePoolWithTag
__C_specific_handler

hal

KeQueryPerformanceCounter

ndis.sys

NdisFreePacket
NdisCloseAdapter
NdisOpenAdapter
NdisAllocatePacketPool
NdisInitializeEvent
NdisFreePacketPool
NdisAllocatePacket
NdisDeregisterProtocol
NdisRegisterProtocol
NdisWaitEvent
NdisSetEvent
NdisResetEvent
NdisSystemProcessorCount
NdisRequest
NdisUnchainBufferAtFront

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 444B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

INIT
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
imCed.dll
.dll windows:5 windows x86 arch:x86

3016f889c27e3e4a9dcb27fd6b2b826f

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1f:1d:34:a2:ba:e3:9d:9b:f9:16:57:e3:d1:9d:8c:81:4c:bf:11:fe:dc:06:44:30:7b:4a:8e:3b:2e:b4:91:1a
Signer

Actual PE Digest

1f:1d:34:a2:ba:e3:9d:9b:f9:16:57:e3:d1:9d:8c:81:4c:bf:11:fe:dc:06:44:30:7b:4a:8e:3b:2e:b4:91:1a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\imCed.pdb

Imports

kernel32

CreateEventW
Process32NextW
Process32FirstW
Module32FirstW
Module32NextW
CreateToolhelp32Snapshot
SystemTimeToFileTime
GetCurrentDirectoryW
GetLocalTime
OutputDebugStringW
OutputDebugStringA
LoadLibraryW
CopyFileW
GetFileAttributesExW
FindClose
FindNextFileW
FindFirstFileW
TerminateThread
Sleep
GetProcessHeap
GetCurrentProcessId
HeapAlloc
DuplicateHandle
HeapFree
DeleteCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
GetModuleFileNameW
CreateFileW
ReadFile
LoadLibraryExW
FreeLibrary
GetModuleHandleW
GetProcAddress
CreateFileMappingW
GetFileSize
UnmapViewOfFile
SetFilePointer
WriteFile
VirtualQuery
SetThreadContext
FlushInstructionCache
GetThreadContext
GetCurrentThread
EnterCriticalSection
GetCurrentThreadId
VirtualAlloc
InterlockedCompareExchange
GetCurrentProcess
VirtualFree
VirtualProtect
VirtualQueryEx
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
CompareFileTime
MoveFileExW
CreateDirectoryW
ExitProcess
VirtualProtectEx
CloseHandle
GetLastError
OpenProcess
ResumeThread
WaitForSingleObject
LeaveCriticalSection
DecodePointer
SetStdHandle
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
SuspendThread
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
SetConsoleCtrlHandler
GetStringTypeW
GetACP
ReadConsoleW
GetConsoleMode
FreeLibraryAndExitThread
ExitThread
CreateThread
WriteConsoleW
GetModuleHandleExW
GetFileType
GetEnvironmentVariableA
GetEnvironmentVariableW
TerminateProcess
SetLastError
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
InterlockedFlushSList
RaiseException
RtlUnwind
ReleaseMutex
GetPrivateProfileStringA
GetComputerNameW
GetDriveTypeW
OpenFileMappingW
OpenMutexW
GetTickCount
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
GetFileAttributesW
GetVersionExW
HeapValidate
HeapSize
MultiByteToWideChar
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
DeleteFileW
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LocalFree
LockFileEx
WideCharToMultiByte
GetSystemTime
FormatMessageA
MapViewOfFile
FlushFileBuffers
QueueUserAPC
SleepEx
GetModuleFileNameA
GetFileSizeEx
GetSystemDirectoryA
SetFileAttributesA
SetFilePointerEx
GetLogicalDrives
DeviceIoControl
GetDriveTypeA
GetVolumeInformationA
LocalAlloc
GetModuleHandleA
SetFileAttributesW
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

user32

DrawTextExW
EnumChildWindows
IsWindow
TabbedTextOutW
GetWindowTextW
wsprintfA
GetClassNameW
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
FindWindowExW
KillTimer
SetWindowLongW
MoveWindow
SetTimer
GetSystemMetrics
CallWindowProcW
GetWindowRect

gdi32

GetCharacterPlacementW
TextOutW
PolyTextOutW

shell32

SHCreateDirectoryExA
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHGetFolderPathW

oleaut32

VariantClear
SysFreeString
VariantInit

shlwapi

StrToIntA
wvnsprintfA
PathFindFileNameA
wnsprintfW
SHSetValueW
PathFileExistsW
PathFindFileNameW
SHGetValueA
wnsprintfA
SHSetValueA
PathAppendW
SHGetValueW
PathFileExistsA
StrToIntExA
StrStrIA

oleacc

AccessibleObjectFromWindow

psapi

GetModuleFileNameExW

ws2_32

shutdown
WSAGetLastError
setsockopt
htons
recv
getnameinfo
ioctlsocket
sendto
connect
socket
inet_addr
WSASetLastError
WSACreateEvent
WSACloseEvent
closesocket
WSAIoctl
bind
inet_ntoa
gethostbyname
gethostname
accept
select
recvfrom
freeaddrinfo
getaddrinfo
send
WSAEnumNetworkEvents
WSAEventSelect
getpeername
listen
getsockname
getsockopt
ntohs
WSAStartup
WSACleanup
__WSAFDIsSet
htonl

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

crypt32

CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertDuplicateCertificateContext

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

wldap32

ord219
ord46
ord14
ord301
ord208
ord41
ord117
ord26
ord27
ord127
ord145
ord167
ord142
ord79
ord133
ord147
ord216

advapi32

CryptAcquireContextW
CryptGetUserKey
CryptExportKey
CryptDestroyHash
CryptSignHashW
CryptSetHashParam
CryptCreateHash
CryptDecrypt
CryptGenRandom
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ConvertStringSecurityDescriptorToSecurityDescriptorW
OpenProcessToken
GetTokenInformation
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExW
RegOpenKeyExA
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
RegQueryValueExA
SetFileSecurityW
RegCloseKey
SetSecurityDescriptorDacl
CryptGetProvParam

Exports

Exports

EnumCurrentQQ
GetALiWWMessage
GetIMBaseAddr
GetIMPath
GetIMVersion
StartSkypeMonitor
WeChatCBTHookProc
WeChatWindowChangedHandler

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 487KB - Virtual size: 487KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 40KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
imDec2.dll
.dll windows:5 windows x86 arch:x86

c4e6eb28643c927ab4b349ebef38ce6c

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c7:92:8a:c1:9f:f9:27:41:8b:6c:4a:d1:31:18:9f:cd:68:3c:0e:a1:f3:72:3f:12:9a:81:07:ef:ba:0f:ef:b7
Signer

Actual PE Digest

c7:92:8a:c1:9f:f9:27:41:8b:6c:4a:d1:31:18:9f:cd:68:3c:0e:a1:f3:72:3f:12:9a:81:07:ef:ba:0f:ef:b7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\imDec2.pdb

Imports

kernel32

WaitForSingleObject
Sleep
SleepEx
QueueUserAPC
CloseHandle
GetModuleHandleW
GlobalMemoryStatus
ConvertThreadToFiber
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
ConvertFiberToThread
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
MoveFileExW
CreateDirectoryW
SetStdHandle
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
SystemTimeToFileTime
GetLocalTime
LoadLibraryW
FileTimeToSystemTime
FindFirstFileExA
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
GetTimeFormatW
GetDateFormatW
GetACP
SetConsoleCtrlHandler
WriteConsoleW
GetFileType
GetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
ExitProcess
InterlockedFlushSList
lstrlenW
DisableThreadLibraryCalls
GetLastError
FormatMessageW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetModuleFileNameA
GetFileSizeEx
WriteFile
OutputDebugStringA
CreateFileA
GetSystemDirectoryA
SetFileAttributesA
SetFilePointerEx
ReadFile
HeapFree
CreateFileW
HeapAlloc
GetFileSize
GetProcessHeap
GetLogicalDrives
FindFirstFileW
FindNextFileW
DeviceIoControl
GetDriveTypeA
SetFilePointer
SetEndOfFile
GetTempPathW
FindClose
GetVolumeInformationA
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
GetModuleHandleA
OpenProcess
SetFileAttributesW
GetFileAttributesExW
DeleteFileA
DeleteFileW
LocalFree
FreeLibrary
CreateFileMappingW
MapViewOfFile
LoadLibraryExW
GetModuleFileNameW
OpenMutexW
OpenFileMappingW
CreateMutexW
InitializeCriticalSection
GetComputerNameW
GetPrivateProfileStringA
GetDriveTypeW
ReleaseMutex
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetSystemTime
FormatMessageA
FlushFileBuffers
TerminateThread
RtlUnwind
RaiseException
GetCurrentDirectoryW

user32

wsprintfA
SystemParametersInfoW
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
GetDesktopWindow
GetClassNameW
FindWindowExW
PostMessageW
GetWindowTextW
FindWindowW
EnumWindows

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CoInitializeEx

oleaut32

VariantInit
SysFreeString
VariantClear

shlwapi

PathFileExistsA
PathAppendA
SHDeleteValueA
SHSetValueW
PathFileExistsW
StrToIntExA
PathAppendW
wnsprintfW
wvnsprintfA
PathFindFileNameA
SHSetValueA
StrStrIW
StrCmpNW
SHGetValueW
wnsprintfA

oleacc

WindowFromAccessibleObject
AccessibleObjectFromWindow

ws2_32

gethostname
shutdown
WSAGetLastError
setsockopt
htons
recv
getnameinfo
ioctlsocket
sendto
recvfrom
freeaddrinfo
connect
socket
inet_addr
WSASetLastError
WSACreateEvent
WSACloseEvent
closesocket
WSAIoctl
inet_ntoa
gethostbyname
getaddrinfo
bind
listen
htonl
accept
select
__WSAFDIsSet
send
WSAEnumNetworkEvents
WSAEventSelect
getpeername
getsockname
getsockopt
ntohs
WSAStartup
WSACleanup

crypt32

CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertCloseStore

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

wldap32

ord79
ord145
ord147
ord219
ord46
ord14
ord216
ord208
ord41
ord117
ord133
ord301
ord167
ord26
ord27
ord127
ord142

advapi32

GetTokenInformation
ConvertSidToStringSidW
RegOpenKeyExW
RegOpenKeyExA
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
RegCloseKey
SetFileSecurityW
RegQueryValueExA
AllocateAndInitializeSid
SetEntriesInAclW
OpenProcessToken
InitializeSecurityDescriptor
RegQueryValueExW

shell32

SHCreateDirectoryExA
SHCreateDirectoryExW
SHGetSpecialFolderPathW

Exports

Exports

StartMonitorWeChat
StartMonitorWhatsApp
StopMonitorWeChat
StopMonitorWhatsApp

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 496KB - Virtual size: 496KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
imDec3.dll
.dll windows:5 windows x86 arch:x86

feec9e1ae01b189e8751bf854ce219e6

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f1:dc:2e:bd:fb:36:32:a9:b5:24:54:54:16:b4:fb:ca:2a:b7:b5:7c:0d:4b:45:e6:4e:3c:e3:13:ab:29:57:e8
Signer

Actual PE Digest

f1:dc:2e:bd:fb:36:32:a9:b5:24:54:54:16:b4:fb:ca:2a:b7:b5:7c:0d:4b:45:e6:4e:3c:e3:13:ab:29:57:e8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\imDec3.pdb

Imports

kernel32

GetLocalTime
LoadLibraryW
FileTimeToSystemTime
GetModuleFileNameW
lstrlenW
DisableThreadLibraryCalls
SleepEx
SystemTimeToFileTime
QueueUserAPC
Sleep
LoadLibraryExW
FreeLibrary
GetModuleHandleW
GetProcAddress
CreateFileMappingW
GetFileSize
UnmapViewOfFile
SetFilePointer
WriteFile
VirtualQuery
FlushInstructionCache
GetThreadContext
GetCurrentThread
SuspendThread
GetCurrentThreadId
InterlockedCompareExchange
GetCurrentProcess
VirtualProtect
VirtualQueryEx
ExitProcess
VirtualProtectEx
SystemTimeToTzSpecificLocalTime
CloseHandle
GetLastError
OpenProcess
ResumeThread
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
CompareFileTime
MoveFileExW
CreateDirectoryW
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
WaitForSingleObject
GetEnvironmentVariableA
GetEnvironmentVariableW
TerminateProcess
FindFirstFileExA
ReadConsoleW
GetConsoleMode
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
GetACP
FreeLibraryAndExitThread
ExitThread
CreateThread
WriteConsoleW
GetModuleHandleExW
GetFileType
GetStdHandle
InterlockedFlushSList
RaiseException
RtlUnwind
TerminateThread
FlushFileBuffers
SetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
FormatMessageW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetStringTypeW
GetCPInfo
GetModuleFileNameA
GetFileSizeEx
OutputDebugStringA
CreateFileA
GetSystemDirectoryA
SetFileAttributesA
SetFilePointerEx
ReadFile
HeapFree
CreateFileW
HeapAlloc
GetProcessHeap
GetLogicalDrives
FindFirstFileW
FindNextFileW
DeviceIoControl
GetDriveTypeA
SetEndOfFile
GetTempPathW
FindClose
GetVolumeInformationA
GetFileAttributesW
GetVersionExW
GetModuleHandleA
SetFileAttributesW
GetFileAttributesExW
DeleteFileA
DeleteFileW
LocalFree
MapViewOfFile
OpenMutexW
OpenFileMappingW
CreateMutexW
InitializeCriticalSection
GetComputerNameW
GetPrivateProfileStringA
GetDriveTypeW
ReleaseMutex
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetSystemTime
FormatMessageA
GetCurrentDirectoryW

user32

wsprintfA
GetClassNameW
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
EnumChildWindows
PostMessageW
FindWindowW
SystemParametersInfoW

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitialize

oleaut32

SysFreeString
VariantInit
VariantClear
SysStringLen

shlwapi

StrToIntExA
PathAppendA
PathAppendW
SHSetValueW
PathFileExistsW
SHGetValueW
PathFileExistsA
wvnsprintfA
SHSetValueA
PathFindFileNameA
SHDeleteValueA
wnsprintfA
StrStrIW
PathFindFileNameW
StrCmpNW
wnsprintfW

oleacc

AccessibleObjectFromWindow
WindowFromAccessibleObject

ws2_32

gethostbyname
shutdown
WSAGetLastError
setsockopt
htons
recv
connect
socket
inet_addr
WSASetLastError
getnameinfo
ioctlsocket
sendto
recvfrom
freeaddrinfo
WSACreateEvent
WSACloseEvent
closesocket
WSAIoctl
bind
inet_ntoa
gethostname
WSACleanup
getaddrinfo
listen
htonl
accept
select
send
WSAEnumNetworkEvents
WSAEventSelect
getpeername
getsockname
getsockopt
ntohs
WSAStartup
__WSAFDIsSet

crypt32

CertFreeCertificateContext
CertCloseStore
CertDuplicateCertificateContext
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFindCertificateInStore

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

wldap32

ord142
ord145
ord219
ord46
ord14
ord216
ord208
ord41
ord117
ord26
ord147
ord301
ord27
ord79
ord127
ord133
ord167

advapi32

SetSecurityDescriptorDacl
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExW
RegOpenKeyExA
InitializeSecurityDescriptor
OpenProcessToken
DeregisterEventSource
SetEntriesInAclW
AllocateAndInitializeSid
RegQueryValueExA
SetFileSecurityW
ReportEventW
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
RegCloseKey

shell32

SHCreateDirectoryExA
SHCreateDirectoryExW
SHGetSpecialFolderPathW

Exports

Exports

DllMain
StartGetDingTalkMessage
StopGetDingTalkMessage

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 487KB - Virtual size: 486KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
import_root_cert.exe
.exe windows:4 windows x86 arch:x86

fe88de5311928dafcb49148bfb766f02

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

75:2e:2e:f9:2b:c4:bb:5e:a1:b5:e3:da:a3:1d:57:59
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

14/10/2016, 00:00

Not After

27/09/2017, 23:59

Subject

CN=NSecsoft(Jinan) Co.\, Ltd.,OU=Development Team,O=NSecsoft(Jinan) Co.\, Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

76:aa:2e:a6:19:81:48:1f:e2:66:c9:9e:33:44:fa:36:61:90:ee:f2:78:57:ab:83:eb:cf:9a:fd:94:6c:2e:fc
Signer

Actual PE Digest

76:aa:2e:a6:19:81:48:1f:e2:66:c9:9e:33:44:fa:36:61:90:ee:f2:78:57:ab:83:eb:cf:9a:fd:94:6c:2e:fc

Digest Algorithm

sha256

PE Digest Matches

true

76:aa:2e:a6:19:81:48:1f:e2:66:c9:9e:33:44:fa:36:61:90:ee:f2:78:57:ab:83:eb:cf:9a:fd:94:6c:2e:fc
Signer

Actual PE Digest

76:aa:2e:a6:19:81:48:1f:e2:66:c9:9e:33:44:fa:36:61:90:ee:f2:78:57:ab:83:eb:cf:9a:fd:94:6c:2e:fc

Digest Algorithm

sha256

PE Digest Matches

true

76:aa:2e:a6:19:81:48:1f:e2:66:c9:9e:33:44:fa:36:61:90:ee:f2:78:57:ab:83:eb:cf:9a:fd:94:6c:2e:fc
Signer

Actual PE Digest

76:aa:2e:a6:19:81:48:1f:e2:66:c9:9e:33:44:fa:36:61:90:ee:f2:78:57:ab:83:eb:cf:9a:fd:94:6c:2e:fc

Digest Algorithm

sha256

PE Digest Matches

true

96:90:eb:f8:2b:1d:36:d0:92:c3:40:78:32:4e:8a:00:31:44:b2:84
Signer

Actual PE Digest

96:90:eb:f8:2b:1d:36:d0:92:c3:40:78:32:4e:8a:00:31:44:b2:84

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

h:\projects\NetFilter2\ProtocolFilters\tools\import_root_cert\Release\import_root_cert.pdb

Imports

kernel32

SetCurrentDirectoryW
CreateProcessW
WaitForSingleObject
CloseHandle
ExpandEnvironmentStringsW
FindFirstFileW
FindNextFileW
FindClose
GetModuleFileNameW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
GetStartupInfoW
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
MultiByteToWideChar
GetLastError
ReadFile
SetFilePointer
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
GetModuleHandleA
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCommandLineW
HeapDestroy
HeapCreate
VirtualFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
Sleep
CreateFileW
InitializeCriticalSection
SetStdHandle
VirtualAlloc
HeapReAlloc
FlushFileBuffers
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapSize
LoadLibraryA
SetEndOfFile
CreateFileA

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
instrap.exe
.exe windows:5 windows x86 arch:x86

4553bae8d80b2880b543bf941a2a7b5c

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

44:96:79:6e:b8:ca:df:1d:2a:d2:27:e2:e8:29:e1:1b:66:be:a2:b5:3d:3a:c9:8a:7a:bb:a7:4c:0b:ed:e5:8d
Signer

Actual PE Digest

44:96:79:6e:b8:ca:df:1d:2a:d2:27:e2:e8:29:e1:1b:66:be:a2:b5:3d:3a:c9:8a:7a:bb:a7:4c:0b:ed:e5:8d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Release\Client\instrap.pdb

Imports

kernel32

SystemTimeToTzSpecificLocalTime
CopyFileW
GetCurrentProcessId
CloseHandle
DeleteFileW
GetSystemDirectoryW
GetModuleFileNameW
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
SleepEx
MoveFileExW
DecodePointer
GetTimeZoneInformation
GetConsoleCP
SetConsoleCtrlHandler
SetStdHandle
LCMapStringW
CompareStringW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetLogicalDrives
HeapFree
GetDriveTypeA
GetVolumeInformationA
CreateFileA
WritePrivateProfileStringA
HeapAlloc
SetFileAttributesA
GetComputerNameW
GetProcessHeap
CreateDirectoryA
GetPrivateProfileStringA
GetTickCount
GetModuleFileNameA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetLocalTime
CreateFileMappingW
MapViewOfFile
Sleep
GetDriveTypeW
ReadFile
CreateMutexW
WaitForSingleObject
GetLastError
LocalFree
CreateProcessW
WriteFile
DeleteFileA
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LockFileEx
GetFileSize
DeleteCriticalSection
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTime
FormatMessageA
FlushFileBuffers
FindFirstFileW
SetLastError
FindNextFileW
DeviceIoControl
FindClose
GetModuleHandleA
OpenProcess
CreateEventW
FileTimeToSystemTime
LoadLibraryExW
GetFileSizeEx
GetSystemDirectoryA
SetFilePointerEx
RtlUnwind
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
ExitProcess
GetModuleHandleExW
GetACP
GetFileType
WriteConsoleW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetConsoleMode
ReadConsoleW
GetStringTypeW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
GetDateFormatW
GetTimeFormatW
GetCurrentDirectoryW

shlwapi

SHSetValueA
wnsprintfA
PathAppendA
StrToIntExA
StrCmpIW
wnsprintfW
PathAppendW
PathFileExistsW
PathFileExistsA
PathFindFileNameA
wvnsprintfA
SHSetValueW

iphlpapi

GetAdaptersAddresses

netapi32

Netbios

ws2_32

inet_addr
socket
connect
recv
htons
setsockopt
gethostbyname
inet_ntoa
gethostname
WSACleanup
__WSAFDIsSet
select
accept
htonl
getaddrinfo
freeaddrinfo
recvfrom
sendto
WSASetLastError
WSACreateEvent
WSACloseEvent
WSAStartup
closesocket
WSAIoctl
bind
ntohs
send
WSAEnumNetworkEvents
WSAEventSelect
getpeername
getsockname
WSAGetLastError
ioctlsocket
getnameinfo
shutdown
getsockopt
listen

crypt32

CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertEnumCertificatesInStore
CertOpenStore
CertFindCertificateInStore
CertCloseStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertGetCertificateContextProperty
CertDuplicateCertificateContext

wldap32

ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145

user32

GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation
wsprintfA

advapi32

RegCloseKey
RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
SetSecurityDescriptorDacl
CryptGenRandom
AllocateAndInitializeSid
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
SetFileSecurityW
GetTokenInformation
RegQueryValueExW
RegQueryValueExA
RegCreateKeyExA
RegCreateKeyExW
RegSetValueExW
RegSetValueExA
OpenProcessToken
FreeSid
CheckTokenMembership
RegOpenKeyExA
ConvertSidToStringSidW

shell32

SHCreateDirectoryExA
SHGetSpecialFolderPathW

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 450KB - Virtual size: 450KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
knurt.dll
.dll windows:5 windows x86 arch:x86

70c6e7e92a44a34f4df46a83f7a045ec

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:04:64:a9:9a:47:bd:fa:51:54:5f:4d:23:99:e3:36:b3:5a:48:62:3f:fc:0a:be:fd:7a:e4:00:a5:ae:23:2c
Signer

Actual PE Digest

0b:04:64:a9:9a:47:bd:fa:51:54:5f:4d:23:99:e3:36:b3:5a:48:62:3f:fc:0a:be:fd:7a:e4:00:a5:ae:23:2c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\knurt.pdb

Imports

kernel32

SystemTimeToTzSpecificLocalTime
MoveFileExW
GetCurrentProcessId
DisableThreadLibraryCalls
MapViewOfFile
CreateFileMappingW
GetModuleHandleW
UnmapViewOfFile
CreateFileW
SetEndOfFile
SetFilePointer
LoadLibraryW
WriteFile
GetFileSizeEx
ReadFile
OpenMutexW
CloseHandle
Process32FirstW
Process32NextW
GetLastError
Sleep
CreateToolhelp32Snapshot
Thread32First
CreateMutexW
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
SleepEx
DecodePointer
SetStdHandle
Thread32Next
GetModuleFileNameW
GetTimeZoneInformation
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
GetStringTypeW
GetACP
ReadConsoleW
GetConsoleMode
FreeLibraryAndExitThread
ExitThread
CreateThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetTickCount
GetDriveTypeW
GetLocalTime
GetModuleFileNameA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
LocalFree
CreateFileA
DeleteFileA
HeapFree
HeapAlloc
SetFileAttributesA
GetProcessHeap
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
UnlockFileEx
GetTempPathW
GetFileAttributesW
GetVersionExW
HeapValidate
HeapSize
MultiByteToWideChar
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileW
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LockFileEx
GetFileSize
DeleteCriticalSection
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTime
FormatMessageA
FlushFileBuffers
GetSystemDirectoryA
SetFilePointerEx
FindFirstFileW
SetLastError
FindNextFileW
FindClose
GetModuleHandleA
OpenProcess
CreateEventW
FileTimeToSystemTime
LoadLibraryExW
RtlUnwind
RaiseException
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetFileType
GetModuleHandleExW
WriteConsoleW
ExitProcess
GetCurrentDirectoryW

user32

RegisterClassExA
UpdateWindow
GetMessageW
DispatchMessageA
IsWindowVisible
SendMessageW
CallNextHookEx
IsWindow
DefWindowProcA
CreateWindowExA
wsprintfA
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
TranslateMessage
LoadIconW
LoadCursorW
EnumThreadWindows
PostQuitMessage
SetWindowsHookExW

gdi32

GetStockObject

shell32

SHCreateDirectoryExA

shlwapi

PathFindFileNameW
wnsprintfA
SHGetValueW
wnsprintfW
PathFindFileNameA
PathAppendW
SHSetValueA
wvnsprintfA

ws2_32

WSASetLastError
WSACreateEvent
WSACloseEvent
closesocket
WSAIoctl
getnameinfo
send
WSAEnumNetworkEvents
shutdown
getpeername
getsockname
getsockopt
ntohs
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
ioctlsocket
freeaddrinfo
recvfrom
sendto
gethostname
WSAGetLastError
setsockopt
htons
recv
connect
WSAEventSelect
socket
bind

crypt32

CertDuplicateCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFreeCertificateContext

wldap32

ord142
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145
ord79
ord133
ord167
ord147
ord301

advapi32

RegOpenKeyExW
RegCloseKey
GetTokenInformation
ConvertSidToStringSidW
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
OpenProcessToken
ReportEventW
DeregisterEventSource
RegQueryValueExW

Exports

Exports

StartIMAudit
StartInjectQQOnX86
StopIMAudit

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 444KB - Virtual size: 443KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 54KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libcrypto-1_1.dll
.dll windows:6 windows x86 arch:x86

840d1b19809c82962b8c90c5984d27e8

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e6:75:50:b5:22:86:de:34:fa:2f:eb:1b:3d:af:0d:39:98:c6:83:2b:53:37:28:b8:a1:65:54:44:8a:d5:64:1b
Signer

Actual PE Digest

e6:75:50:b5:22:86:de:34:fa:2f:eb:1b:3d:af:0d:39:98:c6:83:2b:53:37:28:b8:a1:65:54:44:8a:d5:64:1b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\projects\projectsJ\nfsdk2_1.6\protocolfilters\openssl\out32dll\libcrypto-1_1.pdb

Imports

ws2_32

getaddrinfo
listen
sendto
recvfrom
WSASetLastError
send
recv
shutdown
socket
setsockopt
ntohs
connect
closesocket
bind
accept
WSAGetLastError
WSACleanup
WSAStartup
gethostbyname
getsockopt
getsockname
ioctlsocket
getnameinfo
freeaddrinfo

advapi32

CryptCreateHash
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
DeregisterEventSource
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertOpenStore
CertGetCertificateContextProperty

user32

GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation

bcrypt

BCryptGenRandom

kernel32

SetFileAttributesW
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetStringTypeW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetFullPathNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateFileW
OutputDebugStringW
SetEnvironmentVariableA
GetTimeZoneInformation
SetEndOfFile
GetFullPathNameA
GetFileAttributesExW
GetCurrentThreadId
RtlUnwind
HeapSize
LoadLibraryExW
GetModuleFileNameW
GetProcessHeap
GetDriveTypeW
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
DeleteFiber
SwitchToFiber
FormatMessageW
GetSystemTime
SystemTimeToFileTime
GetLastError
SetLastError
GetStdHandle
GetEnvironmentVariableW
GetFileType
WriteFile
GetVersion
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
CloseHandle
FreeLibrary
LoadLibraryA
LoadLibraryW
GetModuleHandleExW
FindClose
FindFirstFileW
FindNextFileW
WideCharToMultiByte
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedExchangeAdd
InterlockedCompareExchange
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
IsProcessorFeaturePresent
ReadFile
InterlockedExchange
HeapFree
HeapAlloc
EncodePointer
DecodePointer
InterlockedDecrement
ExitProcess
AreFileApisANSI
SetConsoleCtrlHandler
HeapReAlloc
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
FileTimeToSystemTime
GetCommandLineA
GetConsoleCP
InterlockedIncrement
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
CreateSemaphoreW
FatalAppExitA
Sleep
SetStdHandle
FlushFileBuffers
SetFilePointer
SetFilePointerEx
FindFirstFileExW

Exports

Exports

ACCESS_DESCRIPTION_free
ACCESS_DESCRIPTION_it
ACCESS_DESCRIPTION_new
ADMISSIONS_free
ADMISSIONS_get0_admissionAuthority
ADMISSIONS_get0_namingAuthority
ADMISSIONS_get0_professionInfos
ADMISSIONS_it
ADMISSIONS_new
ADMISSIONS_set0_admissionAuthority
ADMISSIONS_set0_namingAuthority
ADMISSIONS_set0_professionInfos
ADMISSION_SYNTAX_free
ADMISSION_SYNTAX_get0_admissionAuthority
ADMISSION_SYNTAX_get0_contentsOfAdmissions
ADMISSION_SYNTAX_it
ADMISSION_SYNTAX_new
ADMISSION_SYNTAX_set0_admissionAuthority
ADMISSION_SYNTAX_set0_contentsOfAdmissions
AES_bi_ige_encrypt
AES_cbc_encrypt
AES_cfb128_encrypt
AES_cfb1_encrypt
AES_cfb8_encrypt
AES_decrypt
AES_ecb_encrypt
AES_encrypt
AES_ige_encrypt
AES_ofb128_encrypt
AES_options
AES_set_decrypt_key
AES_set_encrypt_key
AES_unwrap_key
AES_wrap_key
ASIdOrRange_free
ASIdOrRange_it
ASIdOrRange_new
ASIdentifierChoice_free
ASIdentifierChoice_it
ASIdentifierChoice_new
ASIdentifiers_free
ASIdentifiers_it
ASIdentifiers_new
ASN1_ANY_it
ASN1_BIT_STRING_check
ASN1_BIT_STRING_free
ASN1_BIT_STRING_get_bit
ASN1_BIT_STRING_it
ASN1_BIT_STRING_name_print
ASN1_BIT_STRING_new
ASN1_BIT_STRING_num_asc
ASN1_BIT_STRING_set
ASN1_BIT_STRING_set_asc
ASN1_BIT_STRING_set_bit
ASN1_BMPSTRING_free
ASN1_BMPSTRING_it
ASN1_BMPSTRING_new
ASN1_BOOLEAN_it
ASN1_ENUMERATED_free
ASN1_ENUMERATED_get
ASN1_ENUMERATED_get_int64
ASN1_ENUMERATED_it
ASN1_ENUMERATED_new
ASN1_ENUMERATED_set
ASN1_ENUMERATED_set_int64
ASN1_ENUMERATED_to_BN
ASN1_FBOOLEAN_it
ASN1_GENERALIZEDTIME_adj
ASN1_GENERALIZEDTIME_check
ASN1_GENERALIZEDTIME_free
ASN1_GENERALIZEDTIME_it
ASN1_GENERALIZEDTIME_new
ASN1_GENERALIZEDTIME_print
ASN1_GENERALIZEDTIME_set
ASN1_GENERALIZEDTIME_set_string
ASN1_GENERALSTRING_free
ASN1_GENERALSTRING_it
ASN1_GENERALSTRING_new
ASN1_IA5STRING_free
ASN1_IA5STRING_it
ASN1_IA5STRING_new
ASN1_INTEGER_cmp
ASN1_INTEGER_dup
ASN1_INTEGER_free
ASN1_INTEGER_get
ASN1_INTEGER_get_int64
ASN1_INTEGER_get_uint64
ASN1_INTEGER_it
ASN1_INTEGER_new
ASN1_INTEGER_set
ASN1_INTEGER_set_int64
ASN1_INTEGER_set_uint64
ASN1_INTEGER_to_BN
ASN1_ITEM_get
ASN1_ITEM_lookup
ASN1_NULL_free
ASN1_NULL_it
ASN1_NULL_new
ASN1_OBJECT_create
ASN1_OBJECT_free
ASN1_OBJECT_it
ASN1_OBJECT_new
ASN1_OCTET_STRING_NDEF_it
ASN1_OCTET_STRING_cmp
ASN1_OCTET_STRING_dup
ASN1_OCTET_STRING_free
ASN1_OCTET_STRING_it
ASN1_OCTET_STRING_new
ASN1_OCTET_STRING_set
ASN1_PCTX_free
ASN1_PCTX_get_cert_flags
ASN1_PCTX_get_flags
ASN1_PCTX_get_nm_flags
ASN1_PCTX_get_oid_flags
ASN1_PCTX_get_str_flags
ASN1_PCTX_new
ASN1_PCTX_set_cert_flags
ASN1_PCTX_set_flags
ASN1_PCTX_set_nm_flags
ASN1_PCTX_set_oid_flags
ASN1_PCTX_set_str_flags
ASN1_PRINTABLESTRING_free
ASN1_PRINTABLESTRING_it
ASN1_PRINTABLESTRING_new
ASN1_PRINTABLE_free
ASN1_PRINTABLE_it
ASN1_PRINTABLE_new
ASN1_PRINTABLE_type
ASN1_SCTX_free
ASN1_SCTX_get_app_data
ASN1_SCTX_get_flags
ASN1_SCTX_get_item
ASN1_SCTX_get_template
ASN1_SCTX_new
ASN1_SCTX_set_app_data
ASN1_SEQUENCE_ANY_it
ASN1_SEQUENCE_it
ASN1_SET_ANY_it
ASN1_STRING_TABLE_add
ASN1_STRING_TABLE_cleanup
ASN1_STRING_TABLE_get
ASN1_STRING_clear_free
ASN1_STRING_cmp
ASN1_STRING_copy
ASN1_STRING_data
ASN1_STRING_dup
ASN1_STRING_free
ASN1_STRING_get0_data
ASN1_STRING_get_default_mask
ASN1_STRING_length
ASN1_STRING_length_set
ASN1_STRING_new
ASN1_STRING_print
ASN1_STRING_print_ex
ASN1_STRING_print_ex_fp
ASN1_STRING_set
ASN1_STRING_set0
ASN1_STRING_set_by_NID
ASN1_STRING_set_default_mask
ASN1_STRING_set_default_mask_asc
ASN1_STRING_to_UTF8
ASN1_STRING_type
ASN1_STRING_type_new
ASN1_T61STRING_free
ASN1_T61STRING_it
ASN1_T61STRING_new
ASN1_TBOOLEAN_it
ASN1_TIME_adj
ASN1_TIME_check
ASN1_TIME_cmp_time_t
ASN1_TIME_compare
ASN1_TIME_diff
ASN1_TIME_free
ASN1_TIME_it
ASN1_TIME_new
ASN1_TIME_normalize
ASN1_TIME_print
ASN1_TIME_set
ASN1_TIME_set_string
ASN1_TIME_set_string_X509
ASN1_TIME_to_generalizedtime
ASN1_TIME_to_tm
ASN1_TYPE_cmp
ASN1_TYPE_free
ASN1_TYPE_get
ASN1_TYPE_get_int_octetstring
ASN1_TYPE_get_octetstring
ASN1_TYPE_new
ASN1_TYPE_pack_sequence
ASN1_TYPE_set
ASN1_TYPE_set1
ASN1_TYPE_set_int_octetstring
ASN1_TYPE_set_octetstring
ASN1_TYPE_unpack_sequence
ASN1_UNIVERSALSTRING_free
ASN1_UNIVERSALSTRING_it
ASN1_UNIVERSALSTRING_new
ASN1_UNIVERSALSTRING_to_string
ASN1_UTCTIME_adj
ASN1_UTCTIME_check
ASN1_UTCTIME_cmp_time_t
ASN1_UTCTIME_free
ASN1_UTCTIME_it
ASN1_UTCTIME_new
ASN1_UTCTIME_print
ASN1_UTCTIME_set
ASN1_UTCTIME_set_string
ASN1_UTF8STRING_free
ASN1_UTF8STRING_it
ASN1_UTF8STRING_new
ASN1_VISIBLESTRING_free
ASN1_VISIBLESTRING_it
ASN1_VISIBLESTRING_new
ASN1_add_oid_module
ASN1_add_stable_module
ASN1_bn_print
ASN1_buf_print
ASN1_check_infinite_end
ASN1_const_check_infinite_end
ASN1_d2i_bio
ASN1_d2i_fp
ASN1_digest
ASN1_dup
ASN1_generate_nconf
ASN1_generate_v3
ASN1_get_object
ASN1_i2d_bio
ASN1_i2d_fp
ASN1_item_d2i
ASN1_item_d2i_bio
ASN1_item_d2i_fp
ASN1_item_digest
ASN1_item_dup
ASN1_item_ex_d2i
ASN1_item_ex_free
ASN1_item_ex_i2d
ASN1_item_ex_new
ASN1_item_free
ASN1_item_i2d
ASN1_item_i2d_bio
ASN1_item_i2d_fp
ASN1_item_ndef_i2d
ASN1_item_new
ASN1_item_pack
ASN1_item_print
ASN1_item_sign
ASN1_item_sign_ctx
ASN1_item_unpack
ASN1_item_verify
ASN1_mbstring_copy
ASN1_mbstring_ncopy
ASN1_object_size
ASN1_parse
ASN1_parse_dump
ASN1_put_eoc
ASN1_put_object
ASN1_sign
ASN1_str2mask
ASN1_tag2bit
ASN1_tag2str
ASN1_verify
ASRange_free
ASRange_it
ASRange_new
ASYNC_WAIT_CTX_clear_fd
ASYNC_WAIT_CTX_free
ASYNC_WAIT_CTX_get_all_fds
ASYNC_WAIT_CTX_get_changed_fds
ASYNC_WAIT_CTX_get_fd
ASYNC_WAIT_CTX_new
ASYNC_WAIT_CTX_set_wait_fd
ASYNC_block_pause
ASYNC_cleanup_thread
ASYNC_get_current_job
ASYNC_get_wait_ctx
ASYNC_init_thread
ASYNC_is_capable
ASYNC_pause_job
ASYNC_start_job
ASYNC_unblock_pause
AUTHORITY_INFO_ACCESS_free
AUTHORITY_INFO_ACCESS_it
AUTHORITY_INFO_ACCESS_new
AUTHORITY_KEYID_free
AUTHORITY_KEYID_it
AUTHORITY_KEYID_new
BASIC_CONSTRAINTS_free
BASIC_CONSTRAINTS_it
BASIC_CONSTRAINTS_new
BF_cbc_encrypt
BF_cfb64_encrypt
BF_decrypt
BF_ecb_encrypt
BF_encrypt
BF_ofb64_encrypt
BF_options
BF_set_key
BIGNUM_it
BIO_ADDRINFO_address
BIO_ADDRINFO_family
BIO_ADDRINFO_free
BIO_ADDRINFO_next
BIO_ADDRINFO_protocol
BIO_ADDRINFO_socktype
BIO_ADDR_clear
BIO_ADDR_family
BIO_ADDR_free
BIO_ADDR_hostname_string
BIO_ADDR_new
BIO_ADDR_path_string
BIO_ADDR_rawaddress
BIO_ADDR_rawmake
BIO_ADDR_rawport
BIO_ADDR_service_string
BIO_accept
BIO_accept_ex
BIO_asn1_get_prefix
BIO_asn1_get_suffix
BIO_asn1_set_prefix
BIO_asn1_set_suffix
BIO_bind
BIO_callback_ctrl
BIO_clear_flags
BIO_closesocket
BIO_connect
BIO_copy_next_retry
BIO_ctrl
BIO_ctrl_get_read_request
BIO_ctrl_get_write_guarantee
BIO_ctrl_pending
BIO_ctrl_reset_read_request
BIO_ctrl_wpending
BIO_debug_callback
BIO_dgram_non_fatal_error
BIO_dump
BIO_dump_cb
BIO_dump_fp
BIO_dump_indent
BIO_dump_indent_cb
BIO_dump_indent_fp
BIO_dup_chain
BIO_f_asn1
BIO_f_base64
BIO_f_buffer
BIO_f_cipher
BIO_f_linebuffer
BIO_f_md
BIO_f_nbio_test
BIO_f_null
BIO_f_reliable
BIO_fd_non_fatal_error
BIO_fd_should_retry
BIO_find_type
BIO_free
BIO_free_all
BIO_get_accept_socket
BIO_get_callback
BIO_get_callback_arg
BIO_get_callback_ex
BIO_get_data
BIO_get_ex_data
BIO_get_host_ip
BIO_get_init
BIO_get_new_index
BIO_get_port
BIO_get_retry_BIO
BIO_get_retry_reason
BIO_get_shutdown
BIO_gethostbyname
BIO_gets
BIO_hex_string
BIO_indent
BIO_int_ctrl
BIO_listen
BIO_lookup
BIO_lookup_ex
BIO_meth_free
BIO_meth_get_callback_ctrl
BIO_meth_get_create
BIO_meth_get_ctrl
BIO_meth_get_destroy
BIO_meth_get_gets
BIO_meth_get_puts
BIO_meth_get_read
BIO_meth_get_read_ex
BIO_meth_get_write
BIO_meth_get_write_ex
BIO_meth_new
BIO_meth_set_callback_ctrl
BIO_meth_set_create
BIO_meth_set_ctrl
BIO_meth_set_destroy
BIO_meth_set_gets
BIO_meth_set_puts
BIO_meth_set_read
BIO_meth_set_read_ex
BIO_meth_set_write
BIO_meth_set_write_ex
BIO_method_name
BIO_method_type
BIO_new
BIO_new_CMS
BIO_new_NDEF
BIO_new_PKCS7
BIO_new_accept
BIO_new_bio_pair
BIO_new_connect
BIO_new_dgram
BIO_new_fd
BIO_new_file
BIO_new_fp
BIO_new_mem_buf
BIO_new_socket
BIO_next
BIO_nread
BIO_nread0
BIO_number_read
BIO_number_written
BIO_nwrite
BIO_nwrite0
BIO_parse_hostserv
BIO_pop
BIO_printf
BIO_ptr_ctrl
BIO_push
BIO_puts
BIO_read
BIO_read_ex
BIO_s_accept
BIO_s_bio
BIO_s_connect
BIO_s_datagram
BIO_s_fd
BIO_s_file
BIO_s_log
BIO_s_mem
BIO_s_null
BIO_s_secmem
BIO_s_socket
BIO_set_callback
BIO_set_callback_arg
BIO_set_callback_ex
BIO_set_cipher
BIO_set_data
BIO_set_ex_data
BIO_set_flags
BIO_set_init
BIO_set_next
BIO_set_retry_reason
BIO_set_shutdown
BIO_set_tcp_ndelay
BIO_snprintf
BIO_sock_error
BIO_sock_info
BIO_sock_init
BIO_sock_non_fatal_error
BIO_sock_should_retry
BIO_socket
BIO_socket_ioctl
BIO_socket_nbio
BIO_test_flags
BIO_up_ref
BIO_vfree
BIO_vprintf
BIO_vsnprintf
BIO_write
BIO_write_ex
BN_BLINDING_convert
BN_BLINDING_convert_ex
BN_BLINDING_create_param
BN_BLINDING_free
BN_BLINDING_get_flags
BN_BLINDING_invert
BN_BLINDING_invert_ex
BN_BLINDING_is_current_thread
BN_BLINDING_lock
BN_BLINDING_new
BN_BLINDING_set_current_thread
BN_BLINDING_set_flags
BN_BLINDING_unlock
BN_BLINDING_update
BN_CTX_end
BN_CTX_free
BN_CTX_get
BN_CTX_new
BN_CTX_secure_new
BN_CTX_start
BN_GENCB_call
BN_GENCB_free
BN_GENCB_get_arg
BN_GENCB_new
BN_GENCB_set
BN_GENCB_set_old
BN_GF2m_add
BN_GF2m_arr2poly
BN_GF2m_mod
BN_GF2m_mod_arr
BN_GF2m_mod_div
BN_GF2m_mod_div_arr
BN_GF2m_mod_exp

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 608KB - Virtual size: 607KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libcrypto-3.dll
.dll windows:6 windows x86 arch:x86

5f9211e3d08e35021939396d29c31164

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e3:10:f4:dc:20:b7:6e:6e:2d:c7:27:04:7b:a0:d0:82:fc:f4:ef:5c:2e:1f:b0:bf:ad:a1:40:4a:47:0b:d1:88
Signer

Actual PE Digest

e3:10:f4:dc:20:b7:6e:6e:2d:c7:27:04:7b:a0:d0:82:fc:f4:ef:5c:2e:1f:b0:bf:ad:a1:40:4a:47:0b:d1:88

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\projects\projectsJ\nfsdk2_1.6\protocolfilters\openssl\out32dll\libcrypto-3.pdb

Imports

ws2_32

htons
accept
sendto
recvfrom
send
recv
shutdown
socket
setsockopt
listen
connect
closesocket
bind
htonl
WSACleanup
WSAStartup
select
getsockopt
getsockname
ioctlsocket
WSAGetLastError
WSASetLastError
getservbyname
getservbyport
gethostbyname
gethostbyaddr
ntohs
inet_ntoa
inet_addr

advapi32

CryptCreateHash
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
DeregisterEventSource
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertOpenStore
CertGetCertificateContextProperty

user32

GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation

bcrypt

BCryptGenRandom

kernel32

SetFileAttributesW
GetFileAttributesExW
GetModuleFileNameA
HeapSize
LoadLibraryExW
GetModuleFileNameW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
WriteConsoleW
GetStringTypeW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetFullPathNameW
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateFileW
OutputDebugStringW
SetEnvironmentVariableA
GetTimeZoneInformation
SetEndOfFile
GetFullPathNameA
RtlUnwind
FindFirstFileW
GetDriveTypeW
FindFirstFileExW
SetFilePointerEx
SetFilePointer
FlushFileBuffers
SetStdHandle
ConvertThreadToFiberEx
ConvertFiberToThread
CreateFiberEx
DeleteFiber
SwitchToFiber
GetSystemDirectoryA
FreeLibrary
GetProcAddress
FormatMessageA
LoadLibraryA
Sleep
GetSystemTime
SystemTimeToFileTime
GetLastError
SetLastError
CloseHandle
LoadLibraryW
GetEnvironmentVariableW
GetStdHandle
GetFileType
WriteFile
GetVersion
GetModuleHandleW
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetModuleHandleExW
GetSystemInfo
VirtualAlloc
VirtualFree
VirtualProtect
VirtualLock
FindClose
FindNextFileW
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InterlockedExchangeAdd
InterlockedCompareExchange
InterlockedCompareExchange64
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
GetCurrentProcess
TerminateProcess
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapFree
EnterCriticalSection
LeaveCriticalSection
IsDebuggerPresent
IsProcessorFeaturePresent
ReadFile
InterlockedExchange
HeapAlloc
EncodePointer
DecodePointer
InterlockedDecrement
ExitProcess
AreFileApisANSI
SetConsoleCtrlHandler
HeapReAlloc
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
FileTimeToSystemTime
GetCommandLineA
GetConsoleCP
InterlockedIncrement
IsValidCodePage
GetOEMCP
GetCPInfo
GetCurrentThread
GetProcessHeap
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
FatalAppExitA
GetStartupInfoW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateSemaphoreW

Exports

Exports

ACCESS_DESCRIPTION_free
ACCESS_DESCRIPTION_it
ACCESS_DESCRIPTION_new
ADMISSIONS_free
ADMISSIONS_get0_admissionAuthority
ADMISSIONS_get0_namingAuthority
ADMISSIONS_get0_professionInfos
ADMISSIONS_it
ADMISSIONS_new
ADMISSIONS_set0_admissionAuthority
ADMISSIONS_set0_namingAuthority
ADMISSIONS_set0_professionInfos
ADMISSION_SYNTAX_free
ADMISSION_SYNTAX_get0_admissionAuthority
ADMISSION_SYNTAX_get0_contentsOfAdmissions
ADMISSION_SYNTAX_it
ADMISSION_SYNTAX_new
ADMISSION_SYNTAX_set0_admissionAuthority
ADMISSION_SYNTAX_set0_contentsOfAdmissions
AES_bi_ige_encrypt
AES_cbc_encrypt
AES_cfb128_encrypt
AES_cfb1_encrypt
AES_cfb8_encrypt
AES_decrypt
AES_ecb_encrypt
AES_encrypt
AES_ige_encrypt
AES_ofb128_encrypt
AES_options
AES_set_decrypt_key
AES_set_encrypt_key
AES_unwrap_key
AES_wrap_key
ASIdOrRange_free
ASIdOrRange_it
ASIdOrRange_new
ASIdentifierChoice_free
ASIdentifierChoice_it
ASIdentifierChoice_new
ASIdentifiers_free
ASIdentifiers_it
ASIdentifiers_new
ASN1_ANY_it
ASN1_BIT_STRING_check
ASN1_BIT_STRING_free
ASN1_BIT_STRING_get_bit
ASN1_BIT_STRING_it
ASN1_BIT_STRING_name_print
ASN1_BIT_STRING_new
ASN1_BIT_STRING_num_asc
ASN1_BIT_STRING_set
ASN1_BIT_STRING_set_asc
ASN1_BIT_STRING_set_bit
ASN1_BMPSTRING_free
ASN1_BMPSTRING_it
ASN1_BMPSTRING_new
ASN1_BOOLEAN_it
ASN1_ENUMERATED_free
ASN1_ENUMERATED_get
ASN1_ENUMERATED_get_int64
ASN1_ENUMERATED_it
ASN1_ENUMERATED_new
ASN1_ENUMERATED_set
ASN1_ENUMERATED_set_int64
ASN1_ENUMERATED_to_BN
ASN1_FBOOLEAN_it
ASN1_GENERALIZEDTIME_adj
ASN1_GENERALIZEDTIME_check
ASN1_GENERALIZEDTIME_dup
ASN1_GENERALIZEDTIME_free
ASN1_GENERALIZEDTIME_it
ASN1_GENERALIZEDTIME_new
ASN1_GENERALIZEDTIME_print
ASN1_GENERALIZEDTIME_set
ASN1_GENERALIZEDTIME_set_string
ASN1_GENERALSTRING_free
ASN1_GENERALSTRING_it
ASN1_GENERALSTRING_new
ASN1_IA5STRING_free
ASN1_IA5STRING_it
ASN1_IA5STRING_new
ASN1_INTEGER_cmp
ASN1_INTEGER_dup
ASN1_INTEGER_free
ASN1_INTEGER_get
ASN1_INTEGER_get_int64
ASN1_INTEGER_get_uint64
ASN1_INTEGER_it
ASN1_INTEGER_new
ASN1_INTEGER_set
ASN1_INTEGER_set_int64
ASN1_INTEGER_set_uint64
ASN1_INTEGER_to_BN
ASN1_ITEM_get
ASN1_ITEM_lookup
ASN1_NULL_free
ASN1_NULL_it
ASN1_NULL_new
ASN1_OBJECT_create
ASN1_OBJECT_free
ASN1_OBJECT_it
ASN1_OBJECT_new
ASN1_OCTET_STRING_NDEF_it
ASN1_OCTET_STRING_cmp
ASN1_OCTET_STRING_dup
ASN1_OCTET_STRING_free
ASN1_OCTET_STRING_it
ASN1_OCTET_STRING_new
ASN1_OCTET_STRING_set
ASN1_PCTX_free
ASN1_PCTX_get_cert_flags
ASN1_PCTX_get_flags
ASN1_PCTX_get_nm_flags
ASN1_PCTX_get_oid_flags
ASN1_PCTX_get_str_flags
ASN1_PCTX_new
ASN1_PCTX_set_cert_flags
ASN1_PCTX_set_flags
ASN1_PCTX_set_nm_flags
ASN1_PCTX_set_oid_flags
ASN1_PCTX_set_str_flags
ASN1_PRINTABLESTRING_free
ASN1_PRINTABLESTRING_it
ASN1_PRINTABLESTRING_new
ASN1_PRINTABLE_free
ASN1_PRINTABLE_it
ASN1_PRINTABLE_new
ASN1_PRINTABLE_type
ASN1_SCTX_free
ASN1_SCTX_get_app_data
ASN1_SCTX_get_flags
ASN1_SCTX_get_item
ASN1_SCTX_get_template
ASN1_SCTX_new
ASN1_SCTX_set_app_data
ASN1_SEQUENCE_ANY_it
ASN1_SEQUENCE_it
ASN1_SET_ANY_it
ASN1_STRING_TABLE_add
ASN1_STRING_TABLE_cleanup
ASN1_STRING_TABLE_get
ASN1_STRING_clear_free
ASN1_STRING_cmp
ASN1_STRING_copy
ASN1_STRING_data
ASN1_STRING_dup
ASN1_STRING_free
ASN1_STRING_get0_data
ASN1_STRING_get_default_mask
ASN1_STRING_length
ASN1_STRING_length_set
ASN1_STRING_new
ASN1_STRING_print
ASN1_STRING_print_ex
ASN1_STRING_print_ex_fp
ASN1_STRING_set
ASN1_STRING_set0
ASN1_STRING_set_by_NID
ASN1_STRING_set_default_mask
ASN1_STRING_set_default_mask_asc
ASN1_STRING_to_UTF8
ASN1_STRING_type
ASN1_STRING_type_new
ASN1_T61STRING_free
ASN1_T61STRING_it
ASN1_T61STRING_new
ASN1_TBOOLEAN_it
ASN1_TIME_adj
ASN1_TIME_check
ASN1_TIME_cmp_time_t
ASN1_TIME_compare
ASN1_TIME_diff
ASN1_TIME_dup
ASN1_TIME_free
ASN1_TIME_it
ASN1_TIME_new
ASN1_TIME_normalize
ASN1_TIME_print
ASN1_TIME_print_ex
ASN1_TIME_set
ASN1_TIME_set_string
ASN1_TIME_set_string_X509
ASN1_TIME_to_generalizedtime
ASN1_TIME_to_tm
ASN1_TYPE_cmp
ASN1_TYPE_free
ASN1_TYPE_get
ASN1_TYPE_get_int_octetstring
ASN1_TYPE_get_octetstring
ASN1_TYPE_new
ASN1_TYPE_pack_sequence
ASN1_TYPE_set
ASN1_TYPE_set1
ASN1_TYPE_set_int_octetstring
ASN1_TYPE_set_octetstring
ASN1_TYPE_unpack_sequence
ASN1_UNIVERSALSTRING_free
ASN1_UNIVERSALSTRING_it
ASN1_UNIVERSALSTRING_new
ASN1_UNIVERSALSTRING_to_string
ASN1_UTCTIME_adj
ASN1_UTCTIME_check
ASN1_UTCTIME_cmp_time_t
ASN1_UTCTIME_dup
ASN1_UTCTIME_free
ASN1_UTCTIME_it
ASN1_UTCTIME_new
ASN1_UTCTIME_print
ASN1_UTCTIME_set
ASN1_UTCTIME_set_string
ASN1_UTF8STRING_free
ASN1_UTF8STRING_it
ASN1_UTF8STRING_new
ASN1_VISIBLESTRING_free
ASN1_VISIBLESTRING_it
ASN1_VISIBLESTRING_new
ASN1_add_oid_module
ASN1_add_stable_module
ASN1_bn_print
ASN1_buf_print
ASN1_check_infinite_end
ASN1_const_check_infinite_end
ASN1_d2i_bio
ASN1_d2i_fp
ASN1_digest
ASN1_dup
ASN1_generate_nconf
ASN1_generate_v3
ASN1_get_object
ASN1_i2d_bio
ASN1_i2d_fp
ASN1_item_d2i
ASN1_item_d2i_bio
ASN1_item_d2i_bio_ex
ASN1_item_d2i_ex
ASN1_item_d2i_fp
ASN1_item_d2i_fp_ex
ASN1_item_digest
ASN1_item_dup
ASN1_item_ex_d2i
ASN1_item_ex_free
ASN1_item_ex_i2d
ASN1_item_ex_new
ASN1_item_free
ASN1_item_i2d
ASN1_item_i2d_bio
ASN1_item_i2d_fp
ASN1_item_i2d_mem_bio
ASN1_item_ndef_i2d
ASN1_item_new
ASN1_item_new_ex
ASN1_item_pack
ASN1_item_print
ASN1_item_sign
ASN1_item_sign_ctx
ASN1_item_sign_ex
ASN1_item_unpack
ASN1_item_verify
ASN1_item_verify_ctx
ASN1_item_verify_ex
ASN1_mbstring_copy
ASN1_mbstring_ncopy
ASN1_object_size
ASN1_parse
ASN1_parse_dump
ASN1_put_eoc
ASN1_put_object
ASN1_sign
ASN1_str2mask
ASN1_tag2bit
ASN1_tag2str
ASN1_verify
ASRange_free
ASRange_it
ASRange_new
ASYNC_WAIT_CTX_clear_fd
ASYNC_WAIT_CTX_free
ASYNC_WAIT_CTX_get_all_fds
ASYNC_WAIT_CTX_get_callback
ASYNC_WAIT_CTX_get_changed_fds
ASYNC_WAIT_CTX_get_fd
ASYNC_WAIT_CTX_get_status
ASYNC_WAIT_CTX_new
ASYNC_WAIT_CTX_set_callback
ASYNC_WAIT_CTX_set_status
ASYNC_WAIT_CTX_set_wait_fd
ASYNC_block_pause
ASYNC_cleanup_thread
ASYNC_get_current_job
ASYNC_get_wait_ctx
ASYNC_init_thread
ASYNC_is_capable
ASYNC_pause_job
ASYNC_start_job
ASYNC_unblock_pause
AUTHORITY_INFO_ACCESS_free
AUTHORITY_INFO_ACCESS_it
AUTHORITY_INFO_ACCESS_new
AUTHORITY_KEYID_free
AUTHORITY_KEYID_it
AUTHORITY_KEYID_new
BASIC_CONSTRAINTS_free
BASIC_CONSTRAINTS_it
BASIC_CONSTRAINTS_new
BF_cbc_encrypt
BF_cfb64_encrypt
BF_decrypt
BF_ecb_encrypt
BF_encrypt
BF_ofb64_encrypt
BF_options
BF_set_key
BIGNUM_it
BIO_ADDRINFO_address
BIO_ADDRINFO_family
BIO_ADDRINFO_free
BIO_ADDRINFO_next
BIO_ADDRINFO_protocol
BIO_ADDRINFO_socktype
BIO_ADDR_clear
BIO_ADDR_family
BIO_ADDR_free
BIO_ADDR_hostname_string
BIO_ADDR_new
BIO_ADDR_path_string
BIO_ADDR_rawaddress
BIO_ADDR_rawmake
BIO_ADDR_rawport
BIO_ADDR_service_string
BIO_accept
BIO_accept_ex
BIO_asn1_get_prefix
BIO_asn1_get_suffix
BIO_asn1_set_prefix
BIO_asn1_set_suffix
BIO_bind
BIO_callback_ctrl
BIO_clear_flags
BIO_closesocket
BIO_connect
BIO_copy_next_retry
BIO_ctrl
BIO_ctrl_get_read_request
BIO_ctrl_get_write_guarantee
BIO_ctrl_pending
BIO_ctrl_reset_read_request
BIO_ctrl_wpending
BIO_debug_callback
BIO_debug_callback_ex
BIO_dgram_non_fatal_error
BIO_do_connect_retry
BIO_dump
BIO_dump_cb
BIO_dump_fp
BIO_dump_indent
BIO_dump_indent_cb
BIO_dump_indent_fp
BIO_dup_chain
BIO_f_asn1
BIO_f_base64
BIO_f_buffer
BIO_f_cipher
BIO_f_linebuffer
BIO_f_md
BIO_f_nbio_test
BIO_f_null
BIO_f_prefix
BIO_f_readbuffer
BIO_f_reliable
BIO_fd_non_fatal_error
BIO_fd_should_retry
BIO_find_type
BIO_free
BIO_free_all
BIO_get_accept_socket
BIO_get_callback
BIO_get_callback_arg
BIO_get_callback_ex
BIO_get_data
BIO_get_ex_data
BIO_get_host_ip
BIO_get_init
BIO_get_line
BIO_get_new_index
BIO_get_port
BIO_get_retry_BIO
BIO_get_retry_reason
BIO_get_shutdown
BIO_gethostbyname
BIO_gets
BIO_hex_string
BIO_indent
BIO_int_ctrl
BIO_listen
BIO_lookup
BIO_lookup_ex
BIO_meth_free
BIO_meth_get_callback_ctrl
BIO_meth_get_create
BIO_meth_get_ctrl
BIO_meth_get_destroy
BIO_meth_get_gets
BIO_meth_get_puts
BIO_meth_get_read
BIO_meth_get_read_ex
BIO_meth_get_write
BIO_meth_get_write_ex
BIO_meth_new
BIO_meth_set_callback_ctrl
BIO_meth_set_create
BIO_meth_set_ctrl
BIO_meth_set_destroy
BIO_meth_set_gets
BIO_meth_set_puts
BIO_meth_set_read
BIO_meth_set_read_ex
BIO_meth_set_write
BIO_meth_set_write_ex
BIO_method_name
BIO_method_type
BIO_new
BIO_new_CMS
BIO_new_NDEF
BIO_new_PKCS7
BIO_new_accept
BIO_new_bio_pair
BIO_new_connect
BIO_new_dgram
BIO_new_ex
BIO_new_fd
BIO_new_file
BIO_new_fp
BIO_new_from_core_bio
BIO_new_mem_buf
BIO_new_socket
BIO_next
BIO_nread
BIO_nread0
BIO_number_read
BIO_number_written
BIO_nwrite
BIO_nwrite0
BIO_parse_hostserv
BIO_pop
BIO_printf
BIO_ptr_ctrl
BIO_push
BIO_puts
BIO_read
BIO_read_ex
BIO_s_accept
BIO_s_bio
BIO_s_connect
BIO_s_core
BIO_s_datagram
BIO_s_fd
BIO_s_file
BIO_s_log
BIO_s_mem
BIO_s_null
BIO_s_secmem
BIO_s_socket
BIO_set_callback
BIO_set_callback_arg
BIO_set_callback_ex
BIO_set_cipher
BIO_set_data
BIO_set_ex_data
BIO_set_flags
BIO_set_init
BIO_set_next
BIO_set_retry_reason
BIO_set_shutdown
BIO_set_tcp_ndelay
BIO_snprintf
BIO_sock_error
BIO_sock_info
BIO_sock_init
BIO_sock_non_fatal_error
BIO_sock_should_retry
BIO_socket
BIO_socket_ioctl
BIO_socket_nbio
BIO_socket_wait
BIO_test_flags
BIO_up_ref
BIO_vfree
BIO_vprintf
BIO_vsnprintf
BIO_wait
BIO_write
BIO_write_ex
BN_BLINDING_convert
BN_BLINDING_convert_ex
BN_BLINDING_create_param
BN_BLINDING_free
BN_BLINDING_get_flags
BN_BLINDING_invert
BN_BLINDING_invert_ex

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 844KB - Virtual size: 844KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 113KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libcurl.dll
.dll windows:5 windows x86 arch:x86

fb4b222d35294584b54b6d1a0ed66739

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

24:39:07:2a:45:d5:bc:bc:db:10:d6:e0:86:21:96:8c
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

17/06/2015, 00:00

Not After

15/08/2016, 23:59

Subject

CN=NSecsoft(Jinan) Co.\, Ltd.,OU=Development Team,O=NSecsoft(Jinan) Co.\, Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:29:81:a2:e3:f0:93:24:48:66:7f:fa:b6:3e:8b:c8:4b:53:c4:8d:3c:ae:31:08:97:15:ca:5a:72:22:ff:6c
Signer

Actual PE Digest

03:29:81:a2:e3:f0:93:24:48:66:7f:fa:b6:3e:8b:c8:4b:53:c4:8d:3c:ae:31:08:97:15:ca:5a:72:22:ff:6c

Digest Algorithm

sha256

PE Digest Matches

true

03:29:81:a2:e3:f0:93:24:48:66:7f:fa:b6:3e:8b:c8:4b:53:c4:8d:3c:ae:31:08:97:15:ca:5a:72:22:ff:6c
Signer

Actual PE Digest

03:29:81:a2:e3:f0:93:24:48:66:7f:fa:b6:3e:8b:c8:4b:53:c4:8d:3c:ae:31:08:97:15:ca:5a:72:22:ff:6c

Digest Algorithm

sha256

PE Digest Matches

true

03:29:81:a2:e3:f0:93:24:48:66:7f:fa:b6:3e:8b:c8:4b:53:c4:8d:3c:ae:31:08:97:15:ca:5a:72:22:ff:6c
Signer

Actual PE Digest

03:29:81:a2:e3:f0:93:24:48:66:7f:fa:b6:3e:8b:c8:4b:53:c4:8d:3c:ae:31:08:97:15:ca:5a:72:22:ff:6c

Digest Algorithm

sha256

PE Digest Matches

true

9e:d5:4d:30:a4:58:d0:c2:b7:4a:4e:65:47:1c:e2:ba:85:db:d5:bd
Signer

Actual PE Digest

9e:d5:4d:30:a4:58:d0:c2:b7:4a:4e:65:47:1c:e2:ba:85:db:d5:bd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

ws2_32

ntohl
htonl
gethostname
ioctlsocket
getaddrinfo
freeaddrinfo
recvfrom
sendto
select
__WSAFDIsSet
WSASetLastError
connect
socket
closesocket
getpeername
getsockopt
setsockopt
WSAIoctl
WSAStartup
WSACleanup
htons
bind
listen
ntohs
getsockname
accept
send
recv
WSAGetLastError

wldap32

ord22
ord211
ord143
ord60
ord50
ord26
ord30
ord200
ord32
ord35
ord79
ord33
ord301
ord27
ord41
ord46

advapi32

CryptImportKey
CryptEncrypt
CryptDestroyKey
CryptGetHashParam
CryptDestroyHash
CryptReleaseContext
CryptHashData
CryptAcquireContextA
CryptCreateHash
CryptGenRandom

normaliz

IdnToAscii

kernel32

WriteConsoleW
GetTimeZoneInformation
GetStringTypeW
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
GetModuleFileNameW
HeapDestroy
HeapCreate
ExitProcess
RtlUnwind
GetDriveTypeW
GetCurrentDirectoryW
CreateFileA
GetFullPathNameA
IsProcessorFeaturePresent
FlushFileBuffers
GetConsoleMode
GetConsoleCP
WriteFile
LCMapStringW
GetStartupInfoW
SetHandleCount
InitializeCriticalSectionAndSpinCount
SetStdHandle
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
SetUnhandledExceptionFilter
SetEndOfFile
GetProcessHeap
LoadLibraryW
CompareStringW
SetEnvironmentVariableA
CreateFileW
HeapSize
LeaveCriticalSection
UnhandledExceptionFilter
GetModuleHandleW
GetTickCount
ExpandEnvironmentStringsA
ReadFile
PeekNamedPipe
WaitForMultipleObjects
GetFileType
GetStdHandle
FreeLibrary
GetProcAddress
GetLastError
LoadLibraryA
SleepEx
VerifyVersionInfoA
VerSetConditionMask
SetLastError
FormatMessageA
Sleep
CloseHandle
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSection
EnterCriticalSection
MultiByteToWideChar
WideCharToMultiByte
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileInformationByHandle
SetFilePointer
GetSystemTimeAsFileTime
FindClose
GetDriveTypeA
FindFirstFileExA
HeapReAlloc
HeapFree
HeapAlloc
ExitThread
GetCurrentThreadId
CreateThread
GetCurrentProcessId
DecodePointer
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_init
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_maprintf
curl_mfprintf
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_version
curl_version_info

Sections

.text
Size: 296KB - Virtual size: 296KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libssl-1_1.dll
.dll windows:6 windows x86 arch:x86

ccd55b9403591de98429bdee4f605680

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:a3:19:7a:a1:c8:4c:cf:bd:f7:b2:ac:97:d8:20:8c:ad:a9:38:d8:b7:cc:4e:f0:c7:ed:39:29:f1:13:03:10
Signer

Actual PE Digest

d7:a3:19:7a:a1:c8:4c:cf:bd:f7:b2:ac:97:d8:20:8c:ad:a9:38:d8:b7:cc:4e:f0:c7:ed:39:29:f1:13:03:10

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\projects\projectsJ\nfsdk2_1.6\protocolfilters\openssl\out32dll\libssl-1_1.pdb

Imports

libcrypto-1_1

COMP_CTX_new
COMP_CTX_free
BIO_s_mem
EVP_CIPHER_key_length
EVP_MD_CTX_ctrl
EVP_MD_CTX_set_flags
EVP_CIPHER_CTX_new
EVP_CIPHER_CTX_reset
EVP_md5
EVP_sha1
OPENSSL_sk_num
OPENSSL_sk_value
OPENSSL_sk_new_reserve
OPENSSL_sk_pop_free
CRYPTO_memdup
CRYPTO_strdup
EVP_sha256
EVP_PKEY_security_bits
EVP_PKEY_set_type
EVP_PKEY_set1_DH
EVP_PKEY_new
EVP_PKEY_up_ref
EVP_PKEY_free
EVP_PKEY_CTX_new
EVP_PKEY_CTX_new_id
EVP_PKEY_CTX_free
EVP_PKEY_CTX_ctrl
EVP_PKEY_derive_init
EVP_PKEY_derive_set_peer
EVP_PKEY_derive
EVP_PKEY_paramgen_init
EVP_PKEY_paramgen
EVP_PKEY_keygen_init
EVP_PKEY_keygen
EC_GROUP_get_curve_name
EC_KEY_get0_group
X509_NAME_free
X509_free
ASN1_OCTET_STRING_it
INT32_it
ZINT32_it
UINT32_it
ZUINT32_it
ZINT64_it
ZUINT64_it
X509_it
CRYPTO_strndup
ASN1_item_free
ASN1_item_d2i
ASN1_item_i2d
OPENSSL_DIR_read
OPENSSL_DIR_end
OPENSSL_sk_shift
OPENSSL_sk_pop
OPENSSL_sk_set_cmp_func
CRYPTO_THREAD_lock_new
CRYPTO_THREAD_lock_free
CRYPTO_get_ex_new_index
CRYPTO_THREAD_run_once
BIO_s_file
EVP_PKEY_id
OPENSSL_LH_new
OPENSSL_LH_free
OPENSSL_LH_insert
OPENSSL_LH_retrieve
X509_STORE_new
X509_STORE_free
X509_STORE_up_ref
X509_STORE_CTX_new
X509_STORE_CTX_free
X509_STORE_CTX_init
X509_STORE_CTX_set_verify_cb
X509_STORE_add_cert
X509_STORE_CTX_set_ex_data
X509_STORE_CTX_get_error
X509_STORE_CTX_get0_chain
X509_STORE_CTX_get1_chain
X509_STORE_CTX_set_flags
X509_STORE_CTX_get0_param
X509_STORE_CTX_set_default
X509_STORE_CTX_set0_dane
X509_VERIFY_PARAM_set1
X509_VERIFY_PARAM_set_auth_level
X509_VERIFY_PARAM_move_peername
X509_verify_cert_error_string
X509_NAME_dup
i2d_X509_NAME
X509_get_subject_name
X509_up_ref
X509_chain_up_ref
X509_cmp
X509_NAME_hash
X509_verify_cert
PEM_read_bio_X509
X509_get_extension_flags
OPENSSL_sk_new
OPENSSL_sk_insert
OPENSSL_sk_delete
OPENSSL_sk_dup
OPENSSL_sk_sort
CRYPTO_mem_ctrl
OBJ_nid2sn
COMP_get_type
COMP_get_name
COMP_zlib
EVP_enc_null
EVP_get_cipherbyname
EVP_get_digestbyname
EVP_PKEY_asn1_find_str
EVP_PKEY_asn1_get0_info
ENGINE_finish
CONF_parse_list
DH_free
OBJ_sn2nid
EC_curve_nist2nid
EC_KEY_new_by_curve_name
EC_KEY_free
X509_STORE_load_locations
PEM_read_bio_DHparams
ERR_func_error_string
ERR_load_strings_const
OPENSSL_init_crypto
OPENSSL_atexit
err_free_strings_int
OBJ_NAME_add
EVP_md5_sha1
EVP_sha224
EVP_sha384
EVP_sha512
EVP_des_cbc
EVP_des_ede3_cbc
EVP_rc4
EVP_rc4_hmac_md5
EVP_idea_cbc
EVP_rc2_cbc
EVP_rc2_40_cbc
EVP_aes_128_cbc
EVP_aes_128_ccm
EVP_aes_128_gcm
EVP_aes_192_cbc
EVP_aes_256_cbc
EVP_aes_256_ccm
EVP_aes_256_gcm
EVP_aes_128_cbc_hmac_sha1
EVP_aes_256_cbc_hmac_sha1
EVP_aes_128_cbc_hmac_sha256
EVP_aes_256_cbc_hmac_sha256
EVP_aria_128_gcm
EVP_aria_256_gcm
EVP_camellia_128_cbc
EVP_camellia_256_cbc
EVP_chacha20_poly1305
EVP_seed_cbc
EVP_add_cipher
EVP_add_digest
CRYPTO_THREAD_read_lock
CRYPTO_THREAD_write_lock
CRYPTO_THREAD_unlock
CRYPTO_new_ex_data
CRYPTO_dup_ex_data
CRYPTO_free_ex_data
CRYPTO_set_ex_data
CRYPTO_get_ex_data
CRYPTO_realloc
CRYPTO_secure_zalloc
CRYPTO_secure_free
BUF_MEM_free
COMP_CTX_get_method
BIO_int_ctrl
BIO_pop
BIO_free_all
BIO_s_socket
OPENSSL_LH_num_items
ERR_peek_error
OBJ_bsearch_
EVP_CIPHER_CTX_free
X509_STORE_add_lookup
X509_LOOKUP_hash_dir
OPENSSL_cleanse
X509_LOOKUP_ctrl
X509_STORE_set_default_paths
X509_VERIFY_PARAM_new
X509_VERIFY_PARAM_free
X509_VERIFY_PARAM_inherit
X509_VERIFY_PARAM_set_purpose
X509_VERIFY_PARAM_set_trust
X509_VERIFY_PARAM_set_depth
X509_VERIFY_PARAM_set1_host
X509_VERIFY_PARAM_add1_host
X509_VERIFY_PARAM_set_hostflags
X509_VERIFY_PARAM_get0_peername
X509_VERIFY_PARAM_get_depth
d2i_PUBKEY
X509_EXTENSION_free
d2i_X509
X509_get0_pubkey
X509_check_private_key
X509_get_ext_d2i
ASYNC_WAIT_CTX_new
ASYNC_WAIT_CTX_free
ASYNC_WAIT_CTX_get_all_fds
ASYNC_WAIT_CTX_get_changed_fds
ASYNC_start_job
ASYNC_get_current_job
CT_POLICY_EVAL_CTX_new
CT_POLICY_EVAL_CTX_free
CT_POLICY_EVAL_CTX_set1_cert
CT_POLICY_EVAL_CTX_set1_issuer
CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE
CT_POLICY_EVAL_CTX_set_time
SCT_LIST_free
SCT_set_source
SCT_get_validation_status
SCT_LIST_validate
o2i_SCT_LIST
CTLOG_STORE_new
CTLOG_STORE_free
CTLOG_STORE_load_file
CTLOG_STORE_load_default_file
X509_get_key_usage
RAND_priv_bytes
OCSP_response_get1_basic
OCSP_resp_count
OCSP_resp_get0
OCSP_SINGLERESP_get1_ext_d2i
OCSP_BASICRESP_free
OCSP_RESPID_free
OCSP_RESPONSE_free
d2i_OCSP_RESPONSE
conf_ssl_get
conf_ssl_name_find
conf_ssl_get_cmd
RSA_free
RSA_up_ref
d2i_RSAPrivateKey
ERR_peek_last_error
EVP_PKEY_assign
EVP_PKEY_get0_EC_KEY
d2i_PrivateKey
EVP_PKEY_copy_parameters
EVP_PKEY_missing_parameters
EVP_PKEY_cmp
EC_KEY_can_sign
d2i_X509_bio
d2i_RSAPrivateKey_bio
d2i_PrivateKey_bio
X509_get_pubkey
PEM_read_bio
PEM_read_bio_X509_AUX
PEM_read_bio_RSAPrivateKey
PEM_read_bio_PrivateKey
OPENSSL_LH_delete
OPENSSL_LH_doall_arg
OPENSSL_LH_get_down_load
OPENSSL_LH_set_down_load
PEM_ASN1_read_bio
PEM_ASN1_write_bio
PEM_ASN1_read
PEM_ASN1_write
ENGINE_get_ssl_client_cert_function
ENGINE_init
BIO_puts
BIO_dump_indent
BIO_printf
EVP_DigestSignInit
EVP_PKEY_new_raw_private_key
EVP_PKEY_set1_tls_encodedpoint
EVP_PKEY_get1_tls_encodedpoint
i2d_X509_EXTENSIONS
i2d_OCSP_RESPID
EVP_DigestSign
d2i_X509_EXTENSIONS
d2i_OCSP_RESPID
BUF_MEM_new
BUF_MEM_grow_clean
BN_is_zero
BN_num_bits
BN_bin2bn
BN_bn2bin
BN_free
RSA_pkey_ctx_ctrl
DH_new
DH_check_params
DH_set0_pqg
DH_get0_key
DH_set0_key
EVP_Digest
EVP_DigestInit
EVP_DigestVerify
EVP_DigestVerifyInit
EVP_PKEY_size
EVP_PKEY_get0_RSA
EVP_PKEY_get0_DH
EVP_PKEY_encrypt_init
EVP_PKEY_encrypt
ENGINE_load_ssl_client_cert
BUF_reverse
EVP_DigestVerifyFinal
d2i_X509_NAME
i2d_X509
X509_NAME_cmp
ASN1_ANY_it
BN_ucmp
ASN1_TYPE_get
ASN1_item_new
RSA_size
RSA_private_decrypt
DH_get0_pqg
EVP_EncryptInit_ex
EVP_EncryptUpdate
EVP_EncryptFinal
EVP_PKEY_decrypt_init
EVP_PKEY_decrypt
HMAC_CTX_new
HMAC_CTX_free
HMAC_Init_ex
HMAC_Update
HMAC_Final
EVP_PKEY_new_mac_key
BN_new
BN_set_word
BN_get_rfc2409_prime_1024
BN_get_rfc3526_prime_2048
BN_get_rfc3526_prime_3072
BN_get_rfc3526_prime_4096
BN_get_rfc3526_prime_8192
OBJ_ln2nid
EVP_DecryptInit_ex
EVP_DecryptUpdate
EVP_DecryptFinal
EVP_PKEY_get0
EVP_PKEY_get_default_digest_nid
HMAC_size
EC_GROUP_method_of
EC_METHOD_get_field_type
EC_KEY_get_conv_form
X509_get_signature_info
X509_get_signature_nid
X509_get_issuer_name
X509_chain_check_suiteb
ERR_set_mark
ERR_pop_to_mark
BN_clear_free
BN_copy
BN_dup
SRP_create_verifier_BN
SRP_check_known_gN_param
SRP_get_default_gN
SRP_Calc_server_key
SRP_Calc_B
SRP_Verify_A_mod_N
SRP_Calc_u
SRP_Calc_x
SRP_Calc_A
SRP_Calc_client_key
SRP_Verify_B_mod_N
CRYPTO_clear_free
MD5_Transform
MD5_Init
SHA512_Transform
SHA512_Init
SHA384_Init
SHA256_Transform
SHA256_Init
SHA224_Init
SHA1_Transform
SHA1_Init
EVP_DigestFinal
EVP_DigestInit_ex
EVP_MD_type
EVP_CipherFinal_ex
EVP_CipherUpdate
EVP_CipherInit_ex
RAND_bytes
EVP_CIPHER_CTX_ctrl
EVP_DigestSignFinal
EVP_MD_CTX_copy
EVP_DigestFinal_ex
EVP_DigestUpdate
EVP_MD_CTX_copy_ex
EVP_MD_CTX_free
EVP_MD_CTX_new
EVP_Cipher
EVP_CIPHER_CTX_block_size
EVP_CIPHER_iv_length
EVP_CIPHER_block_size
COMP_expand_block
COMP_compress_block
CRYPTO_memcmp
EVP_CIPHER_CTX_iv_length
EVP_CIPHER_CTX_cipher
EVP_CIPHER_flags
EVP_MD_CTX_md
EVP_MD_size
ERR_add_error_data
BIO_snprintf
CRYPTO_malloc
BUF_MEM_grow
OPENSSL_sk_push
OPENSSL_sk_find
OPENSSL_sk_free
OPENSSL_sk_new_null
ERR_clear_error
BIO_ADDR_clear
BIO_ADDR_free
BIO_ADDR_new
BIO_read
BIO_test_flags
ERR_put_error
BIO_copy_next_retry
BIO_f_buffer
BIO_s_connect
BIO_set_retry_reason
BIO_get_retry_reason
BIO_set_next
BIO_next
BIO_find_type
BIO_push
BIO_callback_ctrl
BIO_ctrl
BIO_write
BIO_up_ref
BIO_get_shutdown
BIO_set_shutdown
BIO_get_init
BIO_set_init
BIO_get_data
BIO_set_data
BIO_free
BIO_new
BIO_method_type
BIO_clear_flags
BIO_set_flags
CRYPTO_free
X509_LOOKUP_file
CRYPTO_zalloc

kernel32

CreateFileW
FlushFileBuffers
HeapSize
LoadLibraryW
OutputDebugStringW
WriteConsoleW
SetStdHandle
HeapReAlloc
HeapAlloc
RtlUnwind
SetConsoleCtrlHandler
LoadLibraryExW
FreeLibrary
InterlockedExchange
GetModuleFileNameW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
WriteFile
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetStringTypeW
FatalAppExitA
LeaveCriticalSection
EnterCriticalSection
Sleep
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
HeapFree
GetModuleFileNameA
DeleteCriticalSection
GetFileType
GetStdHandle
GetProcessHeap
AreFileApisANSI
GetModuleHandleExW
ExitProcess
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
CreateSemaphoreW
GetProcAddress
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThread
InterlockedDecrement
InterlockedIncrement
DecodePointer
EncodePointer
GetCurrentThreadId
GetCommandLineA
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
GetLastError
SystemTimeToFileTime
GetSystemTime
SetLastError
CloseHandle

Exports

Exports

BIO_f_ssl
BIO_new_buffer_ssl_connect
BIO_new_ssl
BIO_new_ssl_connect
BIO_ssl_copy_session_id
BIO_ssl_shutdown
DTLS_client_method
DTLS_get_data_mtu
DTLS_method
DTLS_server_method
DTLS_set_timer_cb
DTLSv1_2_client_method
DTLSv1_2_method
DTLSv1_2_server_method
DTLSv1_client_method
DTLSv1_listen
DTLSv1_method
DTLSv1_server_method
ERR_load_SSL_strings
OPENSSL_cipher_name
OPENSSL_init_ssl
PEM_read_SSL_SESSION
PEM_read_bio_SSL_SESSION
PEM_write_SSL_SESSION
PEM_write_bio_SSL_SESSION
SRP_Calc_A_param
SSL_CIPHER_description
SSL_CIPHER_find
SSL_CIPHER_get_auth_nid
SSL_CIPHER_get_bits
SSL_CIPHER_get_cipher_nid
SSL_CIPHER_get_digest_nid
SSL_CIPHER_get_handshake_digest
SSL_CIPHER_get_id
SSL_CIPHER_get_kx_nid
SSL_CIPHER_get_name
SSL_CIPHER_get_protocol_id
SSL_CIPHER_get_version
SSL_CIPHER_is_aead
SSL_CIPHER_standard_name
SSL_COMP_add_compression_method
SSL_COMP_get0_name
SSL_COMP_get_compression_methods
SSL_COMP_get_id
SSL_COMP_get_name
SSL_COMP_set0_compression_methods
SSL_CONF_CTX_clear_flags
SSL_CONF_CTX_finish
SSL_CONF_CTX_free
SSL_CONF_CTX_new
SSL_CONF_CTX_set1_prefix
SSL_CONF_CTX_set_flags
SSL_CONF_CTX_set_ssl
SSL_CONF_CTX_set_ssl_ctx
SSL_CONF_cmd
SSL_CONF_cmd_argv
SSL_CONF_cmd_value_type
SSL_CTX_SRP_CTX_free
SSL_CTX_SRP_CTX_init
SSL_CTX_add1_to_CA_list
SSL_CTX_add_client_CA
SSL_CTX_add_client_custom_ext
SSL_CTX_add_custom_ext
SSL_CTX_add_server_custom_ext
SSL_CTX_add_session
SSL_CTX_callback_ctrl
SSL_CTX_check_private_key
SSL_CTX_clear_options
SSL_CTX_config
SSL_CTX_ct_is_enabled
SSL_CTX_ctrl
SSL_CTX_dane_clear_flags
SSL_CTX_dane_enable
SSL_CTX_dane_mtype_set
SSL_CTX_dane_set_flags
SSL_CTX_enable_ct
SSL_CTX_flush_sessions
SSL_CTX_free
SSL_CTX_get0_CA_list
SSL_CTX_get0_certificate
SSL_CTX_get0_ctlog_store
SSL_CTX_get0_param
SSL_CTX_get0_privatekey
SSL_CTX_get0_security_ex_data
SSL_CTX_get_cert_store
SSL_CTX_get_ciphers
SSL_CTX_get_client_CA_list
SSL_CTX_get_client_cert_cb
SSL_CTX_get_default_passwd_cb
SSL_CTX_get_default_passwd_cb_userdata
SSL_CTX_get_ex_data
SSL_CTX_get_info_callback
SSL_CTX_get_keylog_callback
SSL_CTX_get_max_early_data
SSL_CTX_get_num_tickets
SSL_CTX_get_options
SSL_CTX_get_quiet_shutdown
SSL_CTX_get_record_padding_callback_arg
SSL_CTX_get_recv_max_early_data
SSL_CTX_get_security_callback
SSL_CTX_get_security_level
SSL_CTX_get_ssl_method
SSL_CTX_get_timeout
SSL_CTX_get_verify_callback
SSL_CTX_get_verify_depth
SSL_CTX_get_verify_mode
SSL_CTX_has_client_custom_ext
SSL_CTX_load_verify_locations
SSL_CTX_new
SSL_CTX_remove_session
SSL_CTX_sess_get_get_cb
SSL_CTX_sess_get_new_cb
SSL_CTX_sess_get_remove_cb
SSL_CTX_sess_set_get_cb
SSL_CTX_sess_set_new_cb
SSL_CTX_sess_set_remove_cb
SSL_CTX_sessions
SSL_CTX_set0_CA_list
SSL_CTX_set0_ctlog_store
SSL_CTX_set0_security_ex_data
SSL_CTX_set1_cert_store
SSL_CTX_set1_param
SSL_CTX_set_allow_early_data_cb
SSL_CTX_set_alpn_protos
SSL_CTX_set_alpn_select_cb
SSL_CTX_set_block_padding
SSL_CTX_set_cert_cb
SSL_CTX_set_cert_store
SSL_CTX_set_cert_verify_callback
SSL_CTX_set_cipher_list
SSL_CTX_set_ciphersuites
SSL_CTX_set_client_CA_list
SSL_CTX_set_client_cert_cb
SSL_CTX_set_client_cert_engine
SSL_CTX_set_client_hello_cb
SSL_CTX_set_cookie_generate_cb
SSL_CTX_set_cookie_verify_cb
SSL_CTX_set_ct_validation_callback
SSL_CTX_set_ctlog_list_file
SSL_CTX_set_default_ctlog_list_file
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_set_default_read_buffer_len
SSL_CTX_set_default_verify_dir
SSL_CTX_set_default_verify_file
SSL_CTX_set_default_verify_paths
SSL_CTX_set_ex_data
SSL_CTX_set_generate_session_id
SSL_CTX_set_info_callback
SSL_CTX_set_keylog_callback
SSL_CTX_set_max_early_data
SSL_CTX_set_msg_callback
SSL_CTX_set_next_proto_select_cb
SSL_CTX_set_next_protos_advertised_cb
SSL_CTX_set_not_resumable_session_callback
SSL_CTX_set_num_tickets
SSL_CTX_set_options
SSL_CTX_set_post_handshake_auth
SSL_CTX_set_psk_client_callback
SSL_CTX_set_psk_find_session_callback
SSL_CTX_set_psk_server_callback
SSL_CTX_set_psk_use_session_callback
SSL_CTX_set_purpose
SSL_CTX_set_quiet_shutdown
SSL_CTX_set_record_padding_callback
SSL_CTX_set_record_padding_callback_arg
SSL_CTX_set_recv_max_early_data
SSL_CTX_set_security_callback
SSL_CTX_set_security_level
SSL_CTX_set_session_id_context
SSL_CTX_set_session_ticket_cb
SSL_CTX_set_srp_cb_arg
SSL_CTX_set_srp_client_pwd_callback
SSL_CTX_set_srp_password
SSL_CTX_set_srp_strength
SSL_CTX_set_srp_username
SSL_CTX_set_srp_username_callback
SSL_CTX_set_srp_verify_param_callback
SSL_CTX_set_ssl_version
SSL_CTX_set_stateless_cookie_generate_cb
SSL_CTX_set_stateless_cookie_verify_cb
SSL_CTX_set_timeout
SSL_CTX_set_tlsext_max_fragment_length
SSL_CTX_set_tlsext_use_srtp
SSL_CTX_set_tmp_dh_callback
SSL_CTX_set_trust
SSL_CTX_set_verify
SSL_CTX_set_verify_depth
SSL_CTX_up_ref
SSL_CTX_use_PrivateKey
SSL_CTX_use_PrivateKey_ASN1
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_RSAPrivateKey
SSL_CTX_use_RSAPrivateKey_ASN1
SSL_CTX_use_RSAPrivateKey_file
SSL_CTX_use_cert_and_key
SSL_CTX_use_certificate
SSL_CTX_use_certificate_ASN1
SSL_CTX_use_certificate_chain_file
SSL_CTX_use_certificate_file
SSL_CTX_use_psk_identity_hint
SSL_CTX_use_serverinfo
SSL_CTX_use_serverinfo_ex
SSL_CTX_use_serverinfo_file
SSL_SESSION_dup
SSL_SESSION_free
SSL_SESSION_get0_alpn_selected
SSL_SESSION_get0_cipher
SSL_SESSION_get0_hostname
SSL_SESSION_get0_id_context
SSL_SESSION_get0_peer
SSL_SESSION_get0_ticket
SSL_SESSION_get0_ticket_appdata
SSL_SESSION_get_compress_id
SSL_SESSION_get_ex_data
SSL_SESSION_get_id
SSL_SESSION_get_master_key
SSL_SESSION_get_max_early_data
SSL_SESSION_get_max_fragment_length
SSL_SESSION_get_protocol_version
SSL_SESSION_get_ticket_lifetime_hint
SSL_SESSION_get_time
SSL_SESSION_get_timeout
SSL_SESSION_has_ticket
SSL_SESSION_is_resumable
SSL_SESSION_new
SSL_SESSION_print
SSL_SESSION_print_fp
SSL_SESSION_print_keylog
SSL_SESSION_set1_alpn_selected
SSL_SESSION_set1_hostname
SSL_SESSION_set1_id
SSL_SESSION_set1_id_context
SSL_SESSION_set1_master_key
SSL_SESSION_set1_ticket_appdata
SSL_SESSION_set_cipher
SSL_SESSION_set_ex_data
SSL_SESSION_set_max_early_data
SSL_SESSION_set_protocol_version
SSL_SESSION_set_time
SSL_SESSION_set_timeout
SSL_SESSION_up_ref
SSL_SRP_CTX_free
SSL_SRP_CTX_init
SSL_accept
SSL_add1_host
SSL_add1_to_CA_list
SSL_add_client_CA
SSL_add_dir_cert_subjects_to_stack
SSL_add_file_cert_subjects_to_stack
SSL_add_ssl_module
SSL_alert_desc_string
SSL_alert_desc_string_long
SSL_alert_type_string
SSL_alert_type_string_long
SSL_alloc_buffers
SSL_bytes_to_cipher_list
SSL_callback_ctrl
SSL_certs_clear
SSL_check_chain
SSL_check_private_key
SSL_clear
SSL_clear_options
SSL_client_hello_get0_ciphers
SSL_client_hello_get0_compression_methods
SSL_client_hello_get0_ext
SSL_client_hello_get0_legacy_version
SSL_client_hello_get0_random
SSL_client_hello_get0_session_id
SSL_client_hello_get1_extensions_present
SSL_client_hello_isv2
SSL_client_version
SSL_config
SSL_connect
SSL_copy_session_id
SSL_ct_is_enabled
SSL_ctrl
SSL_dane_clear_flags
SSL_dane_enable
SSL_dane_set_flags
SSL_dane_tlsa_add
SSL_do_handshake
SSL_dup
SSL_dup_CA_list
SSL_enable_ct
SSL_export_keying_material
SSL_export_keying_material_early
SSL_extension_supported
SSL_free
SSL_free_buffers
SSL_get0_CA_list
SSL_get0_alpn_selected
SSL_get0_dane
SSL_get0_dane_authority
SSL_get0_dane_tlsa
SSL_get0_next_proto_negotiated
SSL_get0_param
SSL_get0_peer_CA_list
SSL_get0_peer_scts
SSL_get0_peername
SSL_get0_security_ex_data
SSL_get0_verified_chain
SSL_get1_session
SSL_get1_supported_ciphers
SSL_get_SSL_CTX
SSL_get_all_async_fds
SSL_get_certificate
SSL_get_changed_async_fds
SSL_get_cipher_list
SSL_get_ciphers
SSL_get_client_CA_list
SSL_get_client_ciphers
SSL_get_client_random
SSL_get_current_cipher
SSL_get_current_compression
SSL_get_current_expansion
SSL_get_default_passwd_cb
SSL_get_default_passwd_cb_userdata
SSL_get_default_timeout
SSL_get_early_data_status
SSL_get_error
SSL_get_ex_data
SSL_get_ex_data_X509_STORE_CTX_idx
SSL_get_fd
SSL_get_finished
SSL_get_info_callback
SSL_get_key_update_type
SSL_get_max_early_data
SSL_get_num_tickets
SSL_get_options
SSL_get_peer_cert_chain
SSL_get_peer_certificate
SSL_get_peer_finished
SSL_get_peer_signature_type_nid
SSL_get_pending_cipher
SSL_get_privatekey
SSL_get_psk_identity
SSL_get_psk_identity_hint
SSL_get_quiet_shutdown
SSL_get_rbio
SSL_get_read_ahead
SSL_get_record_padding_callback_arg
SSL_get_recv_max_early_data
SSL_get_rfd
SSL_get_security_callback
SSL_get_security_level
SSL_get_selected_srtp_profile
SSL_get_server_random
SSL_get_servername
SSL_get_servername_type
SSL_get_session
SSL_get_shared_ciphers
SSL_get_shared_sigalgs
SSL_get_shutdown
SSL_get_sigalgs
SSL_get_signature_type_nid
SSL_get_srp_N
SSL_get_srp_g
SSL_get_srp_userinfo
SSL_get_srp_username
SSL_get_srtp_profiles
SSL_get_ssl_method
SSL_get_state
SSL_get_verify_callback
SSL_get_verify_depth
SSL_get_verify_mode
SSL_get_verify_result
SSL_get_version
SSL_get_wbio
SSL_get_wfd
SSL_has_matching_session_id
SSL_has_pending
SSL_in_before
SSL_in_init
SSL_is_dtls
SSL_is_init_finished
SSL_is_server
SSL_key_update
SSL_load_client_CA_file
SSL_new
SSL_peek
SSL_peek_ex
SSL_pending
SSL_read
SSL_read_early_data
SSL_read_ex
SSL_renegotiate
SSL_renegotiate_abbreviated
SSL_renegotiate_pending
SSL_rstate_string
SSL_rstate_string_long
SSL_select_next_proto
SSL_session_reused
SSL_set0_CA_list
SSL_set0_rbio
SSL_set0_security_ex_data
SSL_set0_wbio
SSL_set1_host
SSL_set1_param
SSL_set_SSL_CTX
SSL_set_accept_state
SSL_set_allow_early_data_cb
SSL_set_alpn_protos
SSL_set_bio
SSL_set_block_padding
SSL_set_cert_cb
SSL_set_cipher_list
SSL_set_ciphersuites
SSL_set_client_CA_list
SSL_set_connect_state
SSL_set_ct_validation_callback
SSL_set_debug
SSL_set_default_passwd_cb
SSL_set_default_passwd_cb_userdata
SSL_set_default_read_buffer_len
SSL_set_ex_data
SSL_set_fd
SSL_set_generate_session_id
SSL_set_hostflags
SSL_set_info_callback
SSL_set_max_early_data
SSL_set_msg_callback
SSL_set_not_resumable_session_callback
SSL_set_num_tickets
SSL_set_options
SSL_set_post_handshake_auth
SSL_set_psk_client_callback
SSL_set_psk_find_session_callback
SSL_set_psk_server_callback
SSL_set_psk_use_session_callback
SSL_set_purpose
SSL_set_quiet_shutdown
SSL_set_read_ahead
SSL_set_record_padding_callback
SSL_set_record_padding_callback_arg
SSL_set_recv_max_early_data
SSL_set_rfd
SSL_set_security_callback
SSL_set_security_level
SSL_set_session
SSL_set_session_id_context
SSL_set_session_secret_cb
SSL_set_session_ticket_ext
SSL_set_session_ticket_ext_cb
SSL_set_shutdown
SSL_set_srp_server_param
SSL_set_srp_server_param_pw
SSL_set_ssl_method
SSL_set_tlsext_max_fragment_length
SSL_set_tlsext_use_srtp
SSL_set_tmp_dh_callback
SSL_set_trust
SSL_set_verify
SSL_set_verify_depth
SSL_set_verify_result
SSL_set_wfd
SSL_shutdown
SSL_srp_server_param_with_username
SSL_state_string
SSL_state_string_long
SSL_stateless
SSL_up_ref
SSL_use_PrivateKey
SSL_use_PrivateKey_ASN1
SSL_use_PrivateKey_file
SSL_use_RSAPrivateKey
SSL_use_RSAPrivateKey_ASN1
SSL_use_RSAPrivateKey_file
SSL_use_cert_and_key
SSL_use_certificate
SSL_use_certificate_ASN1
SSL_use_certificate_chain_file
SSL_use_certificate_file
SSL_use_psk_identity_hint
SSL_verify_client_post_handshake
SSL_version
SSL_waiting_for_async
SSL_want
SSL_write
SSL_write_early_data
SSL_write_ex
TLS_client_method
TLS_method
TLS_server_method
TLSv1_1_client_method
TLSv1_1_method
TLSv1_1_server_method
TLSv1_2_client_method
TLSv1_2_method
TLSv1_2_server_method
TLSv1_client_method
TLSv1_method
TLSv1_server_method
d2i_SSL_SESSION
i2d_SSL_SESSION

Sections

.text
Size: 453KB - Virtual size: 453KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libssl-3.dll
.dll windows:6 windows x86 arch:x86

93c29966cac61d073a926989d4a7f069

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:36:50:a7:ab:6e:82:29:84:1a:d1:9b:5f:d1:27:43:56:5d:60:3e:da:32:d5:8f:be:bd:3e:a4:ea:ce:ab:0a
Signer

Actual PE Digest

0a:36:50:a7:ab:6e:82:29:84:1a:d1:9b:5f:d1:27:43:56:5d:60:3e:da:32:d5:8f:be:bd:3e:a4:ea:ce:ab:0a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\projects\projectsJ\nfsdk2_1.6\protocolfilters\openssl\out32dll\libssl-3.pdb

Imports

libcrypto-3

EVP_PKEY_paramgen_init
EVP_PKEY_paramgen
EVP_PKEY_keygen_init
EVP_PKEY_keygen
EVP_PKEY_CTX_set_group_name
X509_NAME_free
X509_free
RAND_bytes_ex
X509_it
ASN1_OCTET_STRING_it
INT32_it
ZINT32_it
UINT32_it
ZUINT32_it
ZINT64_it
ZUINT64_it
CRYPTO_strndup
ASN1_item_free
ASN1_item_d2i
ASN1_item_i2d
OPENSSL_DIR_read
OPENSSL_DIR_end
OPENSSL_sk_shift
OPENSSL_sk_pop
OPENSSL_sk_set_cmp_func
CRYPTO_THREAD_lock_new
CRYPTO_THREAD_lock_free
CRYPTO_get_ex_new_index
CRYPTO_THREAD_run_once
OSSL_LIB_CTX_set0_default
BIO_s_file
BIO_snprintf
OBJ_nid2ln
OBJ_nid2sn
OPENSSL_LH_new
OPENSSL_LH_free
OPENSSL_LH_insert
OPENSSL_LH_retrieve
X509_verify_cert
X509_STORE_new
X509_STORE_free
X509_STORE_up_ref
X509_STORE_CTX_new_ex
X509_STORE_CTX_free
X509_STORE_CTX_init
X509_STORE_CTX_set_verify_cb
X509_STORE_add_cert
X509_STORE_CTX_set_ex_data
X509_STORE_CTX_get_error
X509_STORE_CTX_get0_chain
X509_STORE_CTX_get1_chain
X509_STORE_CTX_set_flags
X509_STORE_CTX_get0_param
X509_STORE_CTX_set_default
X509_STORE_CTX_set0_dane
X509_VERIFY_PARAM_set1
X509_VERIFY_PARAM_set_auth_level
X509_VERIFY_PARAM_move_peername
X509_verify_cert_error_string
X509_NAME_dup
i2d_X509_NAME
X509_new_ex
X509_get_subject_name
X509_up_ref
X509_chain_up_ref
X509_cmp
X509_NAME_hash_ex
PEM_read_bio_X509
OSSL_STORE_open
OSSL_STORE_load
OSSL_STORE_eof
OSSL_STORE_error
OSSL_STORE_close
OSSL_STORE_INFO_get_type
OSSL_STORE_INFO_get0_NAME
OSSL_STORE_INFO_get0_CERT
OSSL_STORE_INFO_free
X509_get_extension_flags
OPENSSL_sk_new
OPENSSL_sk_delete
OPENSSL_sk_unshift
OPENSSL_sk_dup
OPENSSL_sk_sort
COMP_get_type
COMP_get_name
COMP_zlib
EVP_CIPHER_get_block_size
EVP_CIPHER_get_flags
EVP_CIPHER_get_mode
EVP_CIPHER_fetch
EVP_get_cipherbyname
EVP_get_digestbyname
EVP_PKEY_asn1_find_str
EVP_PKEY_asn1_get0_info
EVP_SIGNATURE_free
EVP_SIGNATURE_fetch
EVP_KEYEXCH_free
EVP_KEYEXCH_fetch
CONF_parse_list
ERR_set_mark
ERR_pop_to_mark
OPENSSL_strcasecmp
OPENSSL_strncasecmp
ERR_clear_last_mark
X509_STORE_load_path
X509_STORE_load_file_ex
X509_STORE_load_store_ex
OSSL_DECODER_CTX_free
OSSL_DECODER_from_bio
OSSL_DECODER_CTX_new_for_pkey
ERR_reason_error_string
ERR_load_strings_const
OPENSSL_init_crypto
OPENSSL_atexit
OPENSSL_sk_insert
CRYPTO_THREAD_read_lock
CRYPTO_THREAD_write_lock
CRYPTO_THREAD_unlock
CRYPTO_new_ex_data
CRYPTO_dup_ex_data
CRYPTO_free_ex_data
CRYPTO_set_ex_data
CRYPTO_get_ex_data
CRYPTO_realloc
CRYPTO_secure_zalloc
CRYPTO_secure_free
BUF_MEM_free
COMP_CTX_get_method
BIO_int_ctrl
BIO_pop
BIO_free_all
BIO_s_socket
ASN1_OCTET_STRING_free
OPENSSL_LH_num_items
ERR_peek_error
OBJ_bsearch_
EVP_MD_get0_provider
EVP_CIPHER_up_ref
EVP_CIPHER_free
EVP_MD_fetch
EVP_MD_up_ref
EVP_MD_free
EVP_CIPHER_CTX_free
EVP_PKEY_get_security_bits
X509_STORE_add_lookup
X509_LOOKUP_hash_dir
X509_LOOKUP_file
X509_LOOKUP_store
X509_LOOKUP_ctrl
X509_LOOKUP_ctrl_ex
X509_STORE_set_default_paths_ex
X509_VERIFY_PARAM_new
X509_VERIFY_PARAM_free
X509_VERIFY_PARAM_inherit
X509_VERIFY_PARAM_set_purpose
X509_VERIFY_PARAM_set_trust
X509_VERIFY_PARAM_set_depth
X509_VERIFY_PARAM_set1_host
X509_VERIFY_PARAM_add1_host
X509_VERIFY_PARAM_set_hostflags
X509_VERIFY_PARAM_get0_peername
X509_VERIFY_PARAM_get1_ip_asc
X509_VERIFY_PARAM_set1_ip_asc
X509_VERIFY_PARAM_get_depth
d2i_PUBKEY
X509_EXTENSION_free
d2i_X509
X509_get0_pubkey
X509_check_private_key
X509_get_ext_d2i
ASYNC_WAIT_CTX_new
ASYNC_WAIT_CTX_free
ASYNC_WAIT_CTX_get_all_fds
ASYNC_WAIT_CTX_set_callback
ASYNC_WAIT_CTX_get_status
ASYNC_WAIT_CTX_get_changed_fds
ASYNC_start_job
ASYNC_get_current_job
CT_POLICY_EVAL_CTX_new_ex
CT_POLICY_EVAL_CTX_free
CT_POLICY_EVAL_CTX_set1_cert
CT_POLICY_EVAL_CTX_set1_issuer
CT_POLICY_EVAL_CTX_set_shared_CTLOG_STORE
CT_POLICY_EVAL_CTX_set_time
SCT_LIST_free
SCT_set_source
SCT_get_validation_status
SCT_LIST_validate
o2i_SCT_LIST
CTLOG_STORE_new_ex
CTLOG_STORE_free
CTLOG_STORE_load_file
CTLOG_STORE_load_default_file
X509_get_key_usage
a2i_IPADDRESS
RAND_priv_bytes_ex
EVP_PKEY_decapsulate
OCSP_resp_count
OCSP_resp_get0
OCSP_SINGLERESP_get1_ext_d2i
OCSP_BASICRESP_free
OCSP_RESPID_free
OCSP_RESPONSE_free
d2i_OCSP_RESPONSE
conf_ssl_get
conf_ssl_name_find
conf_ssl_get_cmd
ERR_peek_last_error
EVP_PKEY_can_sign
d2i_PrivateKey_ex
EVP_PKEY_copy_parameters
EVP_PKEY_missing_parameters
EVP_PKEY_eq
d2i_X509_bio
d2i_PrivateKey_ex_bio
X509_get_pubkey
PEM_read_bio
PEM_read_bio_X509_AUX
PEM_read_bio_PrivateKey_ex
RSA_free
RSA_up_ref
d2i_RSAPrivateKey
EVP_PKEY_assign
EVP_PKEY_new
d2i_RSAPrivateKey_bio
PEM_read_bio_RSAPrivateKey
OPENSSL_LH_delete
OPENSSL_LH_get_down_load
OPENSSL_LH_set_down_load
PEM_ASN1_read_bio
PEM_ASN1_write_bio
PEM_ASN1_read
PEM_ASN1_write
BIO_puts
BIO_dump_indent
BIO_printf
OSSL_PARAM_construct_int
OSSL_PARAM_construct_size_t
OSSL_PARAM_construct_utf8_string
EVP_MD_get0_name
EVP_DigestSignInit_ex
EVP_CIPHER_CTX_ctrl
EVP_CIPHER_CTX_set_params
EVP_PKEY_new_mac_key
EVP_PKEY_new_raw_private_key_ex
EVP_KDF_free
EVP_KDF_fetch
EVP_KDF_CTX_new
EVP_KDF_CTX_free
EVP_KDF_derive
CRYPTO_memcmp
BN_free
BN_get_rfc2409_prime_1024
BN_get_rfc3526_prime_2048
BN_get_rfc3526_prime_3072
BN_get_rfc3526_prime_4096
BN_get_rfc3526_prime_8192
OBJ_txt2nid
OBJ_ln2nid
OBJ_sn2nid
OSSL_PARAM_locate_const
OSSL_PARAM_get_int
OSSL_PARAM_get_uint
OSSL_PARAM_free
EVP_CIPHER_CTX_get_iv_length
EVP_DecryptInit_ex
EVP_DecryptUpdate
EVP_DecryptFinal
EVP_MAC_fetch
EVP_MAC_free
EVP_MAC_CTX_new
EVP_MAC_CTX_free
EVP_MAC_CTX_get_mac_size
EVP_MAC_init
EVP_MAC_update
EVP_MAC_final
EVP_PKEY_get_id
EVP_PKEY_get_bits
EVP_PKEY_get_size
EVP_PKEY_set_type
EVP_PKEY_digestsign_supports_digest
EVP_PKEY_set1_encoded_public_key
EVP_KEYMGMT_fetch
EVP_KEYMGMT_free
EVP_KEYMGMT_get0_provider
EVP_PKEY_fromdata_init
EVP_PKEY_fromdata
EVP_PKEY_get_ec_point_conv_form
EVP_PKEY_get_field_type
EVP_PKEY_get_group_name
X509_get_signature_info
X509_get_signature_nid
X509_get_issuer_name
X509_chain_check_suiteb
X509_NAME_cmp
OSSL_PROVIDER_do_all
OSSL_PROVIDER_get_capabilities
OSSL_PARAM_BLD_new
OSSL_PARAM_BLD_to_param
OSSL_PARAM_BLD_free
OSSL_PARAM_BLD_push_uint
OSSL_PARAM_BLD_push_BN
BIO_indent
d2i_X509_NAME
X509_NAME_print_ex
X509_print_ex
PEM_write_bio_X509
EVP_Q_mac
EC_GROUP_get_curve_name
EC_KEY_get0_group
EVP_PKEY_set1_DH
ENGINE_get_ssl_client_cert_function
ENGINE_get_cipher
ENGINE_get_digest
ENGINE_init
ENGINE_finish
ENGINE_load_ssl_client_cert
ENGINE_get_cipher_engine
ENGINE_get_digest_engine
HMAC_size
HMAC_CTX_new
HMAC_CTX_free
HMAC_Init_ex
HMAC_Update
HMAC_Final
BN_is_zero
BN_num_bits
BN_clear_free
BN_copy
BN_bin2bn
BN_bn2bin
BN_dup
BN_ucmp
SRP_create_verifier_BN_ex
SRP_check_known_gN_param
SRP_get_default_gN
SRP_Calc_server_key
SRP_Calc_B_ex
SRP_Verify_A_mod_N
SRP_Calc_u_ex
SRP_Calc_x_ex
SRP_Calc_A
SRP_Calc_client_key_ex
SRP_Verify_B_mod_N
EVP_CIPHER_CTX_get0_cipher
COMP_compress_block
COMP_expand_block
OSSL_PARAM_construct_octet_ptr
EVP_MD_CTX_get_pkey_ctx
EVP_CIPHER_CTX_get_block_size
EVP_Cipher
EVP_MD_CTX_ctrl
EVP_MD_CTX_copy
EVP_CipherUpdate
EVP_DigestSignUpdate
EVP_DigestSignFinal
EVP_CIPHER_CTX_get_params
EVP_PKEY_CTX_set_params
EVP_CipherFinal_ex
EVP_PKEY_get1_encoded_public_key
i2d_X509_EXTENSIONS
i2d_OCSP_RESPID
EVP_DigestSign
d2i_X509_EXTENSIONS
d2i_OCSP_RESPID
BUF_MEM_new
BUF_MEM_grow_clean
ERR_vset_error
EVP_Digest
EVP_DigestInit
EVP_DigestVerify
EVP_DigestVerifyInit_ex
EVP_PKEY_CTX_ctrl
EVP_PKEY_encrypt_init
EVP_PKEY_encrypt
EVP_PKEY_public_check
EVP_PKEY_param_check_quick
EVP_PKEY_CTX_set_rsa_padding
EVP_PKEY_CTX_set_rsa_pss_saltlen
BUF_reverse
EVP_DigestVerifyUpdate
EVP_DigestVerifyFinal
i2d_X509
ASN1_ANY_it
ASN1_TYPE_get
ASN1_item_new
OSSL_PARAM_construct_uint
EVP_EncryptInit_ex
EVP_EncryptUpdate
EVP_EncryptFinal
EVP_PKEY_decrypt_init
EVP_PKEY_decrypt
EVP_PKEY_get_bn_param
EVP_PKEY_decapsulate_init
EVP_PKEY_encapsulate
EVP_PKEY_encapsulate_init
EVP_PKEY_derive
EVP_PKEY_derive_set_peer
EVP_PKEY_derive_init
EVP_PKEY_CTX_free
EVP_PKEY_CTX_new_from_pkey
EVP_PKEY_CTX_new_from_name
EVP_PKEY_free
EVP_PKEY_up_ref
EVP_PKEY_is_a
EVP_PKEY_CTX_set_dh_pad
CRYPTO_strdup
CRYPTO_memdup
OPENSSL_sk_pop_free
OPENSSL_sk_new_reserve
OPENSSL_sk_value
OPENSSL_sk_num
EVP_CIPHER_CTX_reset
EVP_CIPHER_CTX_new
EVP_CipherInit_ex
EVP_DigestFinal_ex
EVP_MD_CTX_copy_ex
EVP_MD_CTX_set_params
EVP_CIPHER_get_iv_length
EVP_CIPHER_get_key_length
EVP_CIPHER_get0_provider
EVP_MD_CTX_get0_md
EVP_MD_get_size
EVP_MD_get_type
OSSL_PARAM_construct_end
OSSL_PARAM_construct_octet_string
BIO_s_mem
COMP_CTX_free
COMP_CTX_new
OPENSSL_cleanse
CRYPTO_clear_free
SHA512_Transform
SHA512_Init
SHA384_Init
SHA256_Transform
SHA256_Init
SHA224_Init
SHA1_Transform
SHA1_Init
MD5_Transform
MD5_Init
EVP_DigestFinal
EVP_DigestUpdate
EVP_DigestInit_ex
EVP_MD_CTX_free
EVP_MD_CTX_new
EVP_MD_is_a
CRYPTO_malloc
OPENSSL_sk_push
OPENSSL_sk_find
OPENSSL_sk_free
OPENSSL_sk_new_null
ERR_clear_error
BIO_ADDR_clear
BIO_ADDR_free
BIO_ADDR_new
BIO_read
BIO_test_flags
BIO_copy_next_retry
BIO_f_buffer
BIO_s_connect
BIO_set_retry_reason
BIO_get_retry_reason
BIO_set_next
BIO_next
BIO_find_type
BIO_push
BIO_callback_ctrl
BIO_ctrl
BIO_write
BIO_up_ref
BIO_get_shutdown
BIO_set_shutdown
BIO_get_init
BIO_set_init
BIO_get_data
BIO_set_data
BIO_free
BIO_new
BIO_method_type
BIO_clear_flags
BIO_set_flags
ERR_set_error
ERR_set_debug
ERR_new
BUF_MEM_grow
CRYPTO_free
OCSP_response_get1_basic
CRYPTO_zalloc

kernel32

FlushFileBuffers
GetFullPathNameA
WriteConsoleW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapSize
LoadLibraryW
OutputDebugStringW
ReadConsoleW
ReadFile
SetEndOfFile
GetTimeZoneInformation
SetStdHandle
GetStringTypeW
HeapReAlloc
HeapAlloc
RtlUnwind
SetFilePointerEx
GetConsoleMode
GetConsoleCP
SetConsoleCtrlHandler
LoadLibraryExW
FreeLibrary
InterlockedExchange
GetModuleFileNameW
WriteFile
CloseHandle
CreateFileW
GetCurrentDirectoryW
SetCurrentDirectoryW
GetFullPathNameW
PeekNamedPipe
GetFileInformationByHandle
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FatalAppExitA
LeaveCriticalSection
EnterCriticalSection
Sleep
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
DeleteCriticalSection
GetFileType
GetStdHandle
GetProcessHeap
CreateSemaphoreW
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
HeapFree
MultiByteToWideChar
AreFileApisANSI
GetProcAddress
GetModuleHandleExW
ExitProcess
FileTimeToSystemTime
GetDriveTypeW
FindFirstFileExW
FindClose
FileTimeToLocalFileTime
GetCurrentThread
InterlockedDecrement
InterlockedIncrement
DecodePointer
EncodePointer
GetCurrentThreadId
GetCommandLineA
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
GetLastError
SystemTimeToFileTime
GetSystemTime
SetLastError
SetEnvironmentVariableA

Exports

Exports

BIO_f_ssl
BIO_new_buffer_ssl_connect
BIO_new_ssl
BIO_new_ssl_connect
BIO_ssl_copy_session_id
BIO_ssl_shutdown
DTLS_client_method
DTLS_get_data_mtu
DTLS_method
DTLS_server_method
DTLS_set_timer_cb
DTLSv1_2_client_method
DTLSv1_2_method
DTLSv1_2_server_method
DTLSv1_client_method
DTLSv1_listen
DTLSv1_method
DTLSv1_server_method
ERR_load_SSL_strings
OPENSSL_cipher_name
OPENSSL_init_ssl
OSSL_default_cipher_list
OSSL_default_ciphersuites
PEM_read_SSL_SESSION
PEM_read_bio_SSL_SESSION
PEM_write_SSL_SESSION
PEM_write_bio_SSL_SESSION
SRP_Calc_A_param
SSL_CIPHER_description
SSL_CIPHER_find
SSL_CIPHER_get_auth_nid
SSL_CIPHER_get_bits
SSL_CIPHER_get_cipher_nid
SSL_CIPHER_get_digest_nid
SSL_CIPHER_get_handshake_digest
SSL_CIPHER_get_id
SSL_CIPHER_get_kx_nid
SSL_CIPHER_get_name
SSL_CIPHER_get_protocol_id
SSL_CIPHER_get_version
SSL_CIPHER_is_aead
SSL_CIPHER_standard_name
SSL_COMP_add_compression_method
SSL_COMP_get0_name
SSL_COMP_get_compression_methods
SSL_COMP_get_id
SSL_COMP_get_name
SSL_COMP_set0_compression_methods
SSL_CONF_CTX_clear_flags
SSL_CONF_CTX_finish
SSL_CONF_CTX_free
SSL_CONF_CTX_new
SSL_CONF_CTX_set1_prefix
SSL_CONF_CTX_set_flags
SSL_CONF_CTX_set_ssl
SSL_CONF_CTX_set_ssl_ctx
SSL_CONF_cmd
SSL_CONF_cmd_argv
SSL_CONF_cmd_value_type
SSL_CTX_SRP_CTX_free
SSL_CTX_SRP_CTX_init
SSL_CTX_add1_to_CA_list
SSL_CTX_add_client_CA
SSL_CTX_add_client_custom_ext
SSL_CTX_add_custom_ext
SSL_CTX_add_server_custom_ext
SSL_CTX_add_session
SSL_CTX_callback_ctrl
SSL_CTX_check_private_key
SSL_CTX_clear_options
SSL_CTX_config
SSL_CTX_ct_is_enabled
SSL_CTX_ctrl
SSL_CTX_dane_clear_flags
SSL_CTX_dane_enable
SSL_CTX_dane_mtype_set
SSL_CTX_dane_set_flags
SSL_CTX_enable_ct
SSL_CTX_flush_sessions
SSL_CTX_free
SSL_CTX_get0_CA_list
SSL_CTX_get0_certificate
SSL_CTX_get0_ctlog_store
SSL_CTX_get0_param
SSL_CTX_get0_privatekey
SSL_CTX_get0_security_ex_data
SSL_CTX_get_cert_store
SSL_CTX_get_ciphers
SSL_CTX_get_client_CA_list
SSL_CTX_get_client_cert_cb
SSL_CTX_get_default_passwd_cb
SSL_CTX_get_default_passwd_cb_userdata
SSL_CTX_get_ex_data
SSL_CTX_get_info_callback
SSL_CTX_get_keylog_callback
SSL_CTX_get_max_early_data
SSL_CTX_get_num_tickets
SSL_CTX_get_options
SSL_CTX_get_quiet_shutdown
SSL_CTX_get_record_padding_callback_arg
SSL_CTX_get_recv_max_early_data
SSL_CTX_get_security_callback
SSL_CTX_get_security_level
SSL_CTX_get_ssl_method
SSL_CTX_get_timeout
SSL_CTX_get_verify_callback
SSL_CTX_get_verify_depth
SSL_CTX_get_verify_mode
SSL_CTX_has_client_custom_ext
SSL_CTX_load_verify_dir
SSL_CTX_load_verify_file
SSL_CTX_load_verify_locations
SSL_CTX_load_verify_store
SSL_CTX_new
SSL_CTX_new_ex
SSL_CTX_remove_session
SSL_CTX_sess_get_get_cb
SSL_CTX_sess_get_new_cb
SSL_CTX_sess_get_remove_cb
SSL_CTX_sess_set_get_cb
SSL_CTX_sess_set_new_cb
SSL_CTX_sess_set_remove_cb
SSL_CTX_sessions
SSL_CTX_set0_CA_list
SSL_CTX_set0_ctlog_store
SSL_CTX_set0_security_ex_data
SSL_CTX_set0_tmp_dh_pkey
SSL_CTX_set1_cert_store
SSL_CTX_set1_param
SSL_CTX_set_allow_early_data_cb
SSL_CTX_set_alpn_protos
SSL_CTX_set_alpn_select_cb
SSL_CTX_set_async_callback
SSL_CTX_set_async_callback_arg
SSL_CTX_set_block_padding
SSL_CTX_set_cert_cb
SSL_CTX_set_cert_store
SSL_CTX_set_cert_verify_callback
SSL_CTX_set_cipher_list
SSL_CTX_set_ciphersuites
SSL_CTX_set_client_CA_list
SSL_CTX_set_client_cert_cb
SSL_CTX_set_client_cert_engine
SSL_CTX_set_client_hello_cb
SSL_CTX_set_cookie_generate_cb
SSL_CTX_set_cookie_verify_cb
SSL_CTX_set_ct_validation_callback
SSL_CTX_set_ctlog_list_file
SSL_CTX_set_default_ctlog_list_file
SSL_CTX_set_default_passwd_cb
SSL_CTX_set_default_passwd_cb_userdata
SSL_CTX_set_default_read_buffer_len
SSL_CTX_set_default_verify_dir
SSL_CTX_set_default_verify_file
SSL_CTX_set_default_verify_paths
SSL_CTX_set_default_verify_store
SSL_CTX_set_ex_data
SSL_CTX_set_generate_session_id
SSL_CTX_set_info_callback
SSL_CTX_set_keylog_callback
SSL_CTX_set_max_early_data
SSL_CTX_set_msg_callback
SSL_CTX_set_next_proto_select_cb
SSL_CTX_set_next_protos_advertised_cb
SSL_CTX_set_not_resumable_session_callback
SSL_CTX_set_num_tickets
SSL_CTX_set_options
SSL_CTX_set_post_handshake_auth
SSL_CTX_set_psk_client_callback
SSL_CTX_set_psk_find_session_callback
SSL_CTX_set_psk_server_callback
SSL_CTX_set_psk_use_session_callback
SSL_CTX_set_purpose
SSL_CTX_set_quiet_shutdown
SSL_CTX_set_record_padding_callback
SSL_CTX_set_record_padding_callback_arg
SSL_CTX_set_recv_max_early_data
SSL_CTX_set_security_callback
SSL_CTX_set_security_level
SSL_CTX_set_session_id_context
SSL_CTX_set_session_ticket_cb
SSL_CTX_set_srp_cb_arg
SSL_CTX_set_srp_client_pwd_callback
SSL_CTX_set_srp_password
SSL_CTX_set_srp_strength
SSL_CTX_set_srp_username
SSL_CTX_set_srp_username_callback
SSL_CTX_set_srp_verify_param_callback
SSL_CTX_set_ssl_version
SSL_CTX_set_stateless_cookie_generate_cb
SSL_CTX_set_stateless_cookie_verify_cb
SSL_CTX_set_timeout
SSL_CTX_set_tlsext_max_fragment_length
SSL_CTX_set_tlsext_ticket_key_evp_cb
SSL_CTX_set_tlsext_use_srtp
SSL_CTX_set_tmp_dh_callback
SSL_CTX_set_trust
SSL_CTX_set_verify
SSL_CTX_set_verify_depth
SSL_CTX_up_ref
SSL_CTX_use_PrivateKey
SSL_CTX_use_PrivateKey_ASN1
SSL_CTX_use_PrivateKey_file
SSL_CTX_use_RSAPrivateKey
SSL_CTX_use_RSAPrivateKey_ASN1
SSL_CTX_use_RSAPrivateKey_file
SSL_CTX_use_cert_and_key
SSL_CTX_use_certificate
SSL_CTX_use_certificate_ASN1
SSL_CTX_use_certificate_chain_file
SSL_CTX_use_certificate_file
SSL_CTX_use_psk_identity_hint
SSL_CTX_use_serverinfo
SSL_CTX_use_serverinfo_ex
SSL_CTX_use_serverinfo_file
SSL_SESSION_dup
SSL_SESSION_free
SSL_SESSION_get0_alpn_selected
SSL_SESSION_get0_cipher
SSL_SESSION_get0_hostname
SSL_SESSION_get0_id_context
SSL_SESSION_get0_peer
SSL_SESSION_get0_ticket
SSL_SESSION_get0_ticket_appdata
SSL_SESSION_get_compress_id
SSL_SESSION_get_ex_data
SSL_SESSION_get_id
SSL_SESSION_get_master_key
SSL_SESSION_get_max_early_data
SSL_SESSION_get_max_fragment_length
SSL_SESSION_get_protocol_version
SSL_SESSION_get_ticket_lifetime_hint
SSL_SESSION_get_time
SSL_SESSION_get_timeout
SSL_SESSION_has_ticket
SSL_SESSION_is_resumable
SSL_SESSION_new
SSL_SESSION_print
SSL_SESSION_print_fp
SSL_SESSION_print_keylog
SSL_SESSION_set1_alpn_selected
SSL_SESSION_set1_hostname
SSL_SESSION_set1_id
SSL_SESSION_set1_id_context
SSL_SESSION_set1_master_key
SSL_SESSION_set1_ticket_appdata
SSL_SESSION_set_cipher
SSL_SESSION_set_ex_data
SSL_SESSION_set_max_early_data
SSL_SESSION_set_protocol_version
SSL_SESSION_set_time
SSL_SESSION_set_timeout
SSL_SESSION_up_ref
SSL_SRP_CTX_free
SSL_SRP_CTX_init
SSL_accept
SSL_add1_host
SSL_add1_to_CA_list
SSL_add_client_CA
SSL_add_dir_cert_subjects_to_stack
SSL_add_file_cert_subjects_to_stack
SSL_add_ssl_module
SSL_add_store_cert_subjects_to_stack
SSL_alert_desc_string
SSL_alert_desc_string_long
SSL_alert_type_string
SSL_alert_type_string_long
SSL_alloc_buffers
SSL_bytes_to_cipher_list
SSL_callback_ctrl
SSL_certs_clear
SSL_check_chain
SSL_check_private_key
SSL_clear
SSL_clear_options
SSL_client_hello_get0_ciphers
SSL_client_hello_get0_compression_methods
SSL_client_hello_get0_ext
SSL_client_hello_get0_legacy_version
SSL_client_hello_get0_random
SSL_client_hello_get0_session_id
SSL_client_hello_get1_extensions_present
SSL_client_hello_isv2
SSL_client_version
SSL_config
SSL_connect
SSL_copy_session_id
SSL_ct_is_enabled
SSL_ctrl
SSL_dane_clear_flags
SSL_dane_enable
SSL_dane_set_flags
SSL_dane_tlsa_add
SSL_do_handshake
SSL_dup
SSL_dup_CA_list
SSL_enable_ct
SSL_export_keying_material
SSL_export_keying_material_early
SSL_extension_supported
SSL_free
SSL_free_buffers
SSL_get0_CA_list
SSL_get0_alpn_selected
SSL_get0_dane
SSL_get0_dane_authority
SSL_get0_dane_tlsa
SSL_get0_next_proto_negotiated
SSL_get0_param
SSL_get0_peer_CA_list
SSL_get0_peer_certificate
SSL_get0_peer_scts
SSL_get0_peername
SSL_get0_security_ex_data
SSL_get0_verified_chain
SSL_get1_peer_certificate
SSL_get1_session
SSL_get1_supported_ciphers
SSL_get_SSL_CTX
SSL_get_all_async_fds
SSL_get_async_status
SSL_get_certificate
SSL_get_changed_async_fds
SSL_get_cipher_list
SSL_get_ciphers
SSL_get_client_CA_list
SSL_get_client_ciphers
SSL_get_client_random
SSL_get_current_cipher
SSL_get_current_compression
SSL_get_current_expansion
SSL_get_default_passwd_cb
SSL_get_default_passwd_cb_userdata
SSL_get_default_timeout
SSL_get_early_data_status
SSL_get_error
SSL_get_ex_data
SSL_get_ex_data_X509_STORE_CTX_idx
SSL_get_fd
SSL_get_finished
SSL_get_info_callback
SSL_get_key_update_type
SSL_get_max_early_data
SSL_get_num_tickets
SSL_get_options
SSL_get_peer_cert_chain
SSL_get_peer_finished
SSL_get_peer_signature_type_nid
SSL_get_pending_cipher
SSL_get_privatekey
SSL_get_psk_identity
SSL_get_psk_identity_hint
SSL_get_quiet_shutdown
SSL_get_rbio
SSL_get_read_ahead
SSL_get_record_padding_callback_arg
SSL_get_recv_max_early_data
SSL_get_rfd
SSL_get_security_callback
SSL_get_security_level
SSL_get_selected_srtp_profile
SSL_get_server_random
SSL_get_servername
SSL_get_servername_type
SSL_get_session
SSL_get_shared_ciphers
SSL_get_shared_sigalgs
SSL_get_shutdown
SSL_get_sigalgs
SSL_get_signature_type_nid
SSL_get_srp_N
SSL_get_srp_g
SSL_get_srp_userinfo
SSL_get_srp_username
SSL_get_srtp_profiles
SSL_get_ssl_method
SSL_get_state
SSL_get_verify_callback
SSL_get_verify_depth
SSL_get_verify_mode
SSL_get_verify_result
SSL_get_version
SSL_get_wbio
SSL_get_wfd
SSL_group_to_name
SSL_has_matching_session_id
SSL_has_pending
SSL_in_before
SSL_in_init
SSL_is_dtls
SSL_is_init_finished
SSL_is_server
SSL_key_update
SSL_load_client_CA_file
SSL_load_client_CA_file_ex
SSL_new
SSL_new_session_ticket
SSL_peek
SSL_peek_ex
SSL_pending
SSL_read
SSL_read_early_data
SSL_read_ex
SSL_renegotiate
SSL_renegotiate_abbreviated
SSL_renegotiate_pending
SSL_rstate_string
SSL_rstate_string_long
SSL_select_next_proto
SSL_sendfile
SSL_session_reused
SSL_set0_CA_list
SSL_set0_rbio
SSL_set0_security_ex_data
SSL_set0_tmp_dh_pkey
SSL_set0_wbio
SSL_set1_host
SSL_set1_param
SSL_set_SSL_CTX
SSL_set_accept_state
SSL_set_allow_early_data_cb
SSL_set_alpn_protos
SSL_set_async_callback
SSL_set_async_callback_arg
SSL_set_bio
SSL_set_block_padding
SSL_set_cert_cb
SSL_set_cipher_list
SSL_set_ciphersuites
SSL_set_client_CA_list
SSL_set_connect_state
SSL_set_ct_validation_callback
SSL_set_debug
SSL_set_default_passwd_cb
SSL_set_default_passwd_cb_userdata
SSL_set_default_read_buffer_len
SSL_set_ex_data
SSL_set_fd
SSL_set_generate_session_id
SSL_set_hostflags
SSL_set_info_callback
SSL_set_max_early_data
SSL_set_msg_callback
SSL_set_not_resumable_session_callback
SSL_set_num_tickets
SSL_set_options
SSL_set_post_handshake_auth
SSL_set_psk_client_callback
SSL_set_psk_find_session_callback
SSL_set_psk_server_callback
SSL_set_psk_use_session_callback
SSL_set_purpose
SSL_set_quiet_shutdown
SSL_set_read_ahead
SSL_set_record_padding_callback
SSL_set_record_padding_callback_arg
SSL_set_recv_max_early_data
SSL_set_rfd
SSL_set_security_callback
SSL_set_security_level
SSL_set_session
SSL_set_session_id_context
SSL_set_session_secret_cb
SSL_set_session_ticket_ext
SSL_set_session_ticket_ext_cb
SSL_set_shutdown
SSL_set_srp_server_param
SSL_set_srp_server_param_pw
SSL_set_ssl_method
SSL_set_tlsext_max_fragment_length
SSL_set_tlsext_use_srtp
SSL_set_tmp_dh_callback
SSL_set_trust
SSL_set_verify
SSL_set_verify_depth
SSL_set_verify_result
SSL_set_wfd
SSL_shutdown
SSL_srp_server_param_with_username
SSL_state_string
SSL_state_string_long
SSL_stateless
SSL_trace
SSL_up_ref
SSL_use_PrivateKey
SSL_use_PrivateKey_ASN1
SSL_use_PrivateKey_file
SSL_use_RSAPrivateKey
SSL_use_RSAPrivateKey_ASN1
SSL_use_RSAPrivateKey_file
SSL_use_cert_and_key
SSL_use_certificate
SSL_use_certificate_ASN1
SSL_use_certificate_chain_file
SSL_use_certificate_file
SSL_use_psk_identity_hint
SSL_verify_client_post_handshake
SSL_version
SSL_waiting_for_async
SSL_want

Sections

.text
Size: 537KB - Virtual size: 537KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mrmsupport.dll
.dll windows:10 windows x86 arch:x86

3a4ed06150bb370f2c7e88467e40f425

Code Sign

33:00:00:01:b2:4a:37:c6:c9:7e:01:68:86:00:01:00:00:01:b2
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:11

Not After

26/07/2019, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:02:39:b2:b4:e8:2a:22:34:49:2f:00:00:00:00:02:39
Certificate

Issuer

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:07

Not After

08/08/2019, 20:07

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0c:52:4c:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

06/07/2010, 20:40

Not After

06/07/2025, 20:50

Subject

CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:6b:14:f0:7b:fe:70:67:e3:3e:93:8f:04:01:3a:49:b6:73:9b:43:47:2f:7b:31:ca:6a:e5:a7:dd:a7:af:ba
Signer

Actual PE Digest

2d:6b:14:f0:7b:fe:70:67:e3:3e:93:8f:04:01:3a:49:b6:73:9b:43:47:2f:7b:31:ca:6a:e5:a7:dd:a7:af:ba

Digest Algorithm

sha256

PE Digest Matches

true

7d:e7:ca:8d:5a:2f:c1:c2:90:2d:93:fe:a2:07:4f:39:0c:a7:17:bd
Signer

Actual PE Digest

7d:e7:ca:8d:5a:2f:c1:c2:90:2d:93:fe:a2:07:4f:39:0c:a7:17:bd

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

MrmSupport.pdb

Imports

msvcrt

_initterm
__CxxFrameHandler3
_unlock
_lock
_amsg_exit
_XcptFilter
??0exception@@QAE@ABQBD@Z
_purecall
_vsnprintf_s
??1exception@@UAE@XZ
_CxxThrowException
_ftol2
_ftol2_sse
memcmp
memcpy
_callnewh
_except_handler4_common
??0exception@@QAE@ABV0@@Z
malloc
?what@exception@@UBEPBDXZ
towupper
wprintf
isalpha
free
_ui64tow_s
_wtoi
iswdigit
_wcsnicmp
wcsncpy_s
wcsrchr
qsort_s
wcschr
towlower
_wcsicmp
wcsnlen
wcscpy_s
bsearch
_wtof
_getwche
fwprintf_s
vswprintf_s
swprintf_s
_vscwprintf_l
??0bad_cast@@QAE@ABV0@@Z
??1bad_cast@@UAE@XZ
wcsncmp
fclose
_errno
_wfopen
fgetwc
wcscspn
strcspn
localeconv
memchr
sprintf_s
_fileno
fread
_filelengthi64
isxdigit
strtol
isdigit
setlocale
___mb_cur_max_func
___lc_handle_func
___lc_codepage_func
__pctype_func
__mb_cur_max
__crtLCMapStringW
__crtGetStringTypeW
abort
__uncaught_exception
wcsstr
memmove_s
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_onexit
??0exception@@QAE@XZ
memcpy_s
_vsnwprintf
__dllonexit
__iob_func
iswalnum
iswspace
vwprintf_s
wprintf_s
memset

oleaut32

VariantClear
SysStringLen
SysFreeString
GetErrorInfo
VariantInit
SysStringByteLen
SysAllocStringByteLen
VariantChangeType
VariantChangeTypeEx
SysAllocString

rpcrt4

UuidCreate
UuidToStringW
RpcStringFreeW

kernel32

InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
LCMapStringEx
GetVolumeNameForVolumeMountPointW
GetVolumePathNameW
SetFilePointer
GetFileSize
GetFullPathNameW
GetFileAttributesW
MultiByteToWideChar
LocalSize
LocalAlloc
LoadLibraryW
FreeLibrary
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
GetModuleHandleExW
WaitForSingleObject
GetCurrentThreadId
ReleaseMutex
FormatMessageW
GetLastError
OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
Sleep
OutputDebugStringA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
CompareStringEx
GetSystemWindowsDirectoryW
FlushFileBuffers
WriteFile
CompareStringOrdinal
FindFirstFileW
FindClose
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
InitializeSRWLock
GetFileAttributesExW
CreateFileW
GetFinalPathNameByHandleW
ReadFile
GetFileSizeEx
UnmapViewOfFile
CreateFileMappingW
MapViewOfFile
WideCharToMultiByte
CompareFileTime
CreateDirectoryW
GetTempPathW
FindNextFileW
DeleteFileW
LocalFree
GetSystemTime
SystemTimeToFileTime

advapi32

EventWriteTransfer
EventRegister
EventUnregister
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
SetNamedSecurityInfoW
AddAccessAllowedAceEx
GetLengthSid
EqualSid
GetAce
GetNamedSecurityInfoW
RegGetValueW
FreeSid
AllocateAndInitializeSid

shlwapi

PathIsNetworkPathW
PathFileExistsW
PathRemoveBackslashW
StrChrW
ord12
PathRelativePathToW
PathIsRelativeW
SHCreateStreamOnFileW

ole32

CoTaskMemFree
CLSIDFromProgID
CoCreateInstance

user32

LoadStringW

Exports

Exports

CreateResourceIndexer
DestroyIndexedResults
DestroyResourceIndexer
IndexFilePath
MrmCreateConfig
MrmCreateConfigInMemory
MrmCreateResourceFile
MrmCreateResourceFileInMemory
MrmCreateResourceIndexer
MrmCreateResourceIndexerFromPreviousPriData
MrmCreateResourceIndexerFromPreviousPriFile
MrmCreateResourceIndexerFromPreviousSchemaData
MrmCreateResourceIndexerFromPreviousSchemaFile
MrmDestroyIndexerAndMessages
MrmDumpPriDataInMemory
MrmDumpPriFile
MrmDumpPriFileInMemory
MrmFreeMemory
MrmIndexEmbeddedData
MrmIndexFile
MrmIndexFileAutoQualifiers
MrmIndexResourceContainerAutoQualifiers
MrmIndexString
MrmPeekResourceIndexerMessages

Sections

.text
Size: 723KB - Virtual size: 723KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
msvcr100.dll
.dll windows:5 windows x86 arch:x86

5271d5ce8b44dd47bc92563e27585466

Code Sign

2e:ab:11:dc:50:ff:5c:9d:cb:c0
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

22/08/2007, 22:31

Not After

25/08/2012, 07:00

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:01:b2:9b:00:00:00:00:00:15
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

21/02/2011, 20:53

Not After

21/05/2012, 20:53

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6a:0b:99:4f:c0:00:25:ab:11:db:45:1f:58:7a:67:a2
Certificate

Issuer

CN=Microsoft Root Authority,OU=Copyright (c) 1997 Microsoft Corp.+OU=Microsoft Corporation

Not Before

16/09/2006, 01:04

Not After

15/09/2019, 07:00

Subject

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:06:94:2d:00:00:00:00:00:09
Certificate

Issuer

CN=Microsoft Timestamping PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

25/07/2008, 19:02

Not After

25/07/2013, 19:12

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:7A82-688A-9F92,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3e:af:5f:68:6d:7f:d3:a2:27:ba:4c:1f:2b:9c:1f:2f:fe:77:af:96:4a:61:56:db:a9:4b:f4:85:8b:2a:e7:56
Signer

Actual PE Digest

3e:af:5f:68:6d:7f:d3:a2:27:ba:4c:1f:2b:9c:1f:2f:fe:77:af:96:4a:61:56:db:a9:4b:f4:85:8b:2a:e7:56

Digest Algorithm

sha256

PE Digest Matches

true

3e:af:5f:68:6d:7f:d3:a2:27:ba:4c:1f:2b:9c:1f:2f:fe:77:af:96:4a:61:56:db:a9:4b:f4:85:8b:2a:e7:56
Signer

Actual PE Digest

3e:af:5f:68:6d:7f:d3:a2:27:ba:4c:1f:2b:9c:1f:2f:fe:77:af:96:4a:61:56:db:a9:4b:f4:85:8b:2a:e7:56

Digest Algorithm

sha256

PE Digest Matches

true

3e:af:5f:68:6d:7f:d3:a2:27:ba:4c:1f:2b:9c:1f:2f:fe:77:af:96:4a:61:56:db:a9:4b:f4:85:8b:2a:e7:56
Signer

Actual PE Digest

3e:af:5f:68:6d:7f:d3:a2:27:ba:4c:1f:2b:9c:1f:2f:fe:77:af:96:4a:61:56:db:a9:4b:f4:85:8b:2a:e7:56

Digest Algorithm

sha256

PE Digest Matches

true

8d:91:f0:a3:ff:41:70:8c:67:d0:ba:79:6d:52:da:88:0c:59:23:cc
Signer

Actual PE Digest

8d:91:f0:a3:ff:41:70:8c:67:d0:ba:79:6d:52:da:88:0c:59:23:cc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

msvcr100.i386.pdb

Imports

kernel32

EncodePointer
DecodePointer
RaiseException
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetCurrentThreadId
TlsGetValue
GetCommandLineW
GetCommandLineA
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitThread
CloseHandle
GetLastError
ResumeThread
CreateThread
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
FindNextFileA
FindFirstFileExA
FindClose
FindNextFileW
FindFirstFileExW
GetLogicalDrives
GetDiskFreeSpaceA
FileTimeToSystemTime
FileTimeToLocalFileTime
SetErrorMode
Sleep
Beep
GetFileAttributesA
SetFileAttributesA
SetEnvironmentVariableA
GetCurrentDirectoryA
SetCurrentDirectoryA
GetCurrentDirectoryW
SetCurrentDirectoryW
GetFullPathNameA
GetDriveTypeW
GetCurrentProcessId
CreateDirectoryA
MoveFileA
RemoveDirectoryA
GetDriveTypeA
DeleteFileA
GetFileAttributesW
SetEnvironmentVariableW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
MoveFileW
RemoveDirectoryW
DeleteFileW
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
LoadLibraryA
FreeLibrary
CreateProcessW
ReadFile
DuplicateHandle
GetCurrentProcess
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetLocalTime
WideCharToMultiByte
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
SetLocalTime
InterlockedPopEntrySList
InterlockedFlushSList
QueryDepthSList
InterlockedPushEntrySList
CreateTimerQueue
CreateTimerQueueTimer
DeleteTimerQueueTimer
SetEvent
CreateEventW
SwitchToThread
SignalObjectAndWait
TryEnterCriticalSection
GetTickCount
VirtualFree
GetVersionExW
SetThreadPriority
VirtualAlloc
GetSystemInfo
GetProcessAffinityMask
VirtualProtect
SetThreadAffinityMask
InitializeSListHead
ReleaseSemaphore
CreateSemaphoreW
WaitForMultipleObjects
GetThreadPriority
LoadLibraryW
SleepEx
OutputDebugStringW
FreeLibraryAndExitThread
GetModuleHandleA
GetThreadTimes
DebugBreak
MultiByteToWideChar
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetTimeFormatA
GetDateFormatA
GetTimeFormatW
GetDateFormatW
RtlUnwind
HeapAlloc
HeapFree
HeapCreate
HeapDestroy
HeapQueryInformation
HeapReAlloc
HeapSize
HeapValidate
HeapCompact
HeapWalk
VirtualQuery
SetHandleCount
GetFileType
GetStartupInfoW
GetFileInformationByHandle
PeekNamedPipe
CreateFileA
CreateFileW
SetFilePointer
GetConsoleCP
GetConsoleMode
FlushFileBuffers
CreatePipe
SetStdHandle
ReadConsoleInputA
SetConsoleMode
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ReadConsoleInputW
WriteConsoleW
ReadConsoleW
SetEndOfFile
GetProcessHeap
InterlockedExchange
LockFile
UnlockFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
SetConsoleCtrlHandler
GetLocaleInfoW
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
LCMapStringW
CompareStringW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
IsProcessorFeaturePresent

Exports

Exports

$I10_OUTPUT
??0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z
??0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z
??0SchedulerPolicy@Concurrency@@QAA@IZZ
??0SchedulerPolicy@Concurrency@@QAE@ABV01@@Z
??0SchedulerPolicy@Concurrency@@QAE@XZ
??0_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ
??0_NonReentrantPPLLock@details@Concurrency@@QAE@XZ
??0_ReaderWriterLock@details@Concurrency@@QAE@XZ
??0_ReentrantBlockingLock@details@Concurrency@@QAE@XZ
??0_ReentrantLock@details@Concurrency@@QAE@XZ
??0_ReentrantPPLLock@details@Concurrency@@QAE@XZ
??0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z
??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z
??0_SpinLock@details@Concurrency@@QAE@ACJ@Z
??0_TaskCollection@details@Concurrency@@QAE@XZ
??0_Timer@details@Concurrency@@IAE@I_N@Z
??0__non_rtti_object@std@@QAE@ABV01@@Z
??0__non_rtti_object@std@@QAE@PBD@Z
??0bad_cast@std@@AAE@PBQBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??0bad_target@Concurrency@@QAE@PBD@Z
??0bad_target@Concurrency@@QAE@XZ
??0bad_typeid@std@@QAE@ABV01@@Z
??0bad_typeid@std@@QAE@PBD@Z
??0context_self_unblock@Concurrency@@QAE@PBD@Z
??0context_self_unblock@Concurrency@@QAE@XZ
??0context_unblock_unbalanced@Concurrency@@QAE@PBD@Z
??0context_unblock_unbalanced@Concurrency@@QAE@XZ
??0critical_section@Concurrency@@QAE@XZ
??0default_scheduler_exists@Concurrency@@QAE@PBD@Z
??0default_scheduler_exists@Concurrency@@QAE@XZ
??0event@Concurrency@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??0improper_lock@Concurrency@@QAE@PBD@Z
??0improper_lock@Concurrency@@QAE@XZ
??0improper_scheduler_attach@Concurrency@@QAE@PBD@Z
??0improper_scheduler_attach@Concurrency@@QAE@XZ
??0improper_scheduler_detach@Concurrency@@QAE@PBD@Z
??0improper_scheduler_detach@Concurrency@@QAE@XZ
??0improper_scheduler_reference@Concurrency@@QAE@PBD@Z
??0improper_scheduler_reference@Concurrency@@QAE@XZ
??0invalid_link_target@Concurrency@@QAE@PBD@Z
??0invalid_link_target@Concurrency@@QAE@XZ
??0invalid_multiple_scheduling@Concurrency@@QAE@PBD@Z
??0invalid_multiple_scheduling@Concurrency@@QAE@XZ
??0invalid_operation@Concurrency@@QAE@PBD@Z
??0invalid_operation@Concurrency@@QAE@XZ
??0invalid_oversubscribe_operation@Concurrency@@QAE@PBD@Z
??0invalid_oversubscribe_operation@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_key@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_key@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_value@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_value@Concurrency@@QAE@XZ
??0message_not_found@Concurrency@@QAE@PBD@Z
??0message_not_found@Concurrency@@QAE@XZ
??0missing_wait@Concurrency@@QAE@PBD@Z
??0missing_wait@Concurrency@@QAE@XZ
??0nested_scheduler_missing_detach@Concurrency@@QAE@PBD@Z
??0nested_scheduler_missing_detach@Concurrency@@QAE@XZ
??0operation_timed_out@Concurrency@@QAE@PBD@Z
??0operation_timed_out@Concurrency@@QAE@XZ
??0reader_writer_lock@Concurrency@@QAE@XZ
??0scheduler_not_attached@Concurrency@@QAE@PBD@Z
??0scheduler_not_attached@Concurrency@@QAE@XZ
??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z
??0scheduler_resource_allocation_error@Concurrency@@QAE@PBDJ@Z
??0scoped_lock@critical_section@Concurrency@@QAE@AAV12@@Z
??0scoped_lock@reader_writer_lock@Concurrency@@QAE@AAV12@@Z
??0scoped_lock_read@reader_writer_lock@Concurrency@@QAE@AAV12@@Z
??0task_canceled@details@Concurrency@@QAE@PBD@Z
??0task_canceled@details@Concurrency@@QAE@XZ
??0unsupported_os@Concurrency@@QAE@PBD@Z
??0unsupported_os@Concurrency@@QAE@XZ
??1SchedulerPolicy@Concurrency@@QAE@XZ
??1_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ
??1_ReentrantBlockingLock@details@Concurrency@@QAE@XZ
??1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@XZ
??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@XZ
??1_SpinLock@details@Concurrency@@QAE@XZ
??1_TaskCollection@details@Concurrency@@QAE@XZ
??1_Timer@details@Concurrency@@IAE@XZ
??1__non_rtti_object@std@@UAE@XZ
??1bad_cast@std@@UAE@XZ
??1bad_typeid@std@@UAE@XZ
??1critical_section@Concurrency@@QAE@XZ
??1event@Concurrency@@QAE@XZ
??1exception@std@@UAE@XZ
??1reader_writer_lock@Concurrency@@QAE@XZ
??1scoped_lock@critical_section@Concurrency@@QAE@XZ
??1scoped_lock@reader_writer_lock@Concurrency@@QAE@XZ
??1scoped_lock_read@reader_writer_lock@Concurrency@@QAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??2@YAPAXIHPBDH@Z
??3@YAXPAX@Z
??4?$_SpinWait@$00@details@Concurrency@@QAEAAV012@ABV012@@Z
??4?$_SpinWait@$0A@@details@Concurrency@@QAEAAV012@ABV012@@Z
??4SchedulerPolicy@Concurrency@@QAEAAV01@ABV01@@Z
??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z
??4bad_cast@std@@QAEAAV01@ABV01@@Z
??4bad_typeid@std@@QAEAAV01@ABV01@@Z
??4exception@std@@QAEAAV01@ABV01@@Z
??8type_info@@QBE_NABV0@@Z
??9type_info@@QBE_NABV0@@Z
??_7__non_rtti_object@std@@6B@
??_7bad_cast@std@@6B@
??_7bad_typeid@std@@6B@
??_7exception@@6B@
??_7exception@std@@6B@
??_F?$_SpinWait@$00@details@Concurrency@@QAEXXZ
??_F?$_SpinWait@$0A@@details@Concurrency@@QAEXXZ
??_Fbad_cast@std@@QAEXXZ
??_Fbad_typeid@std@@QAEXXZ
??_U@YAPAXI@Z
??_U@YAPAXIHPBDH@Z
??_V@YAXPAX@Z
?Alloc@Concurrency@@YAPAXI@Z
?Block@Context@Concurrency@@SAXXZ
?Create@CurrentScheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z
?Create@Scheduler@Concurrency@@SAPAV12@ABVSchedulerPolicy@2@@Z
?CreateResourceManager@Concurrency@@YAPAUIResourceManager@1@XZ
?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@XZ
?CurrentContext@Context@Concurrency@@SAPAV12@XZ
?Detach@CurrentScheduler@Concurrency@@SAXXZ
?DisableTracing@Concurrency@@YAJXZ
?EnableTracing@Concurrency@@YAJXZ
?Free@Concurrency@@YAXPAX@Z
?Get@CurrentScheduler@Concurrency@@SAPAVScheduler@2@XZ
?GetExecutionContextId@Concurrency@@YAIXZ
?GetNumberOfVirtualProcessors@CurrentScheduler@Concurrency@@SAIXZ
?GetOSVersion@Concurrency@@YA?AW4OSVersion@IResourceManager@1@XZ
?GetPolicy@CurrentScheduler@Concurrency@@SA?AVSchedulerPolicy@2@XZ
?GetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z
?GetProcessorCount@Concurrency@@YAIXZ
?GetProcessorNodeCount@Concurrency@@YAIXZ
?GetSchedulerId@Concurrency@@YAIXZ
?GetSharedTimerQueue@details@Concurrency@@YAPAXXZ
?Id@Context@Concurrency@@SAIXZ
?Id@CurrentScheduler@Concurrency@@SAIXZ
?IsCurrentTaskCollectionCanceling@Context@Concurrency@@SA_NXZ
?Log2@details@Concurrency@@YAKI@Z
?Oversubscribe@Context@Concurrency@@SAX_N@Z
?RegisterShutdownEvent@CurrentScheduler@Concurrency@@SAXPAX@Z
?ResetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXXZ
?ScheduleGroupId@Context@Concurrency@@SAIXZ
?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0@Z
?SetConcurrencyLimits@SchedulerPolicy@Concurrency@@QAEXII@Z
?SetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z
?SetPolicyValue@SchedulerPolicy@Concurrency@@QAEIW4PolicyElementKey@2@I@Z
?VirtualProcessorId@Context@Concurrency@@SAIXZ
?Yield@Context@Concurrency@@SAXXZ
?_Abort@_StructuredTaskCollection@details@Concurrency@@AAEXXZ
?_Acquire@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Acquire@_NonReentrantPPLLock@details@Concurrency@@QAEXPAX@Z
?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Acquire@_ReentrantLock@details@Concurrency@@QAEXXZ
?_Acquire@_ReentrantPPLLock@details@Concurrency@@QAEXPAX@Z
?_AcquireRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_AcquireWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_Cancel@_StructuredTaskCollection@details@Concurrency@@QAEXXZ
?_Cancel@_TaskCollection@details@Concurrency@@QAEXXZ
?_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IAEXXZ
?_ConcRT_Assert@details@Concurrency@@YAXPBD0H@Z
?_ConcRT_CoreAssert@details@Concurrency@@YAXPBD0H@Z
?_ConcRT_DumpMessage@details@Concurrency@@YAXPB_WZZ
?_ConcRT_Trace@details@Concurrency@@YAXHPB_WZZ
?_Copy_str@exception@std@@AAEXPBD@Z
?_DoYield@?$_SpinWait@$00@details@Concurrency@@IAEXXZ
?_DoYield@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ
?_IsCanceling@_StructuredTaskCollection@details@Concurrency@@QAE_NXZ
?_IsCanceling@_TaskCollection@details@Concurrency@@QAE_NXZ
?_Name_base@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Name_base_internal@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_NumberOfSpins@?$_SpinWait@$00@details@Concurrency@@IAEKXZ
?_NumberOfSpins@?$_SpinWait@$0A@@details@Concurrency@@IAEKXZ
?_Release@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Release@_NonReentrantPPLLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantPPLLock@details@Concurrency@@QAEXXZ
?_ReleaseRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_Reset@?$_SpinWait@$00@details@Concurrency@@IAEXXZ
?_Reset@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ
?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z
?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z
?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z
?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z
?_SetSpinCount@?$_SpinWait@$00@details@Concurrency@@QAEXI@Z
?_SetSpinCount@?$_SpinWait@$0A@@details@Concurrency@@QAEXI@Z
?_ShouldSpinAgain@?$_SpinWait@$00@details@Concurrency@@IAE_NXZ
?_ShouldSpinAgain@?$_SpinWait@$0A@@details@Concurrency@@IAE_NXZ
?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ
?_SpinOnce@?$_SpinWait@$0A@@details@Concurrency@@QAE_NXZ
?_SpinYield@Context@Concurrency@@SAXXZ
?_Start@_Timer@details@Concurrency@@IAEXXZ
?_Stop@_Timer@details@Concurrency@@IAEXXZ
?_Tidy@exception@std@@AAEXXZ
?_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z
?_TryAcquire@_NonReentrantBlockingLock@details@Concurrency@@QAE_NXZ
?_TryAcquire@_ReentrantBlockingLock@details@Concurrency@@QAE_NXZ
?_TryAcquire@_ReentrantLock@details@Concurrency@@QAE_NXZ
?_TryAcquireWrite@_ReaderWriterLock@details@Concurrency@@QAE_NXZ
?_Type_info_dtor@type_info@@CAXPAV1@@Z
?_Type_info_dtor_internal@type_info@@CAXPAV1@@Z
?_UnderlyingYield@details@Concurrency@@YAXXZ
?_ValidateExecute@@YAHP6GHXZ@Z
?_ValidateRead@@YAHPBXI@Z
?_ValidateWrite@@YAHPAXI@Z
?_Value@_SpinCount@details@Concurrency@@SAIXZ
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCompare@@YA_NPBX0@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?_inconsistency@@YAXXZ
?_invalid_parameter@@YAXPBG00II@Z
?_is_exception_typeof@@YAHABVtype_info@@PAU_EXCEPTION_POINTERS@@@Z
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
?_open@@YAHPBDHH@Z
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
?_set_new_handler@@YAP6AHI@ZH@Z
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?_sopen@@YAHPBDHHH@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?_wopen@@YAHPB_WHH@Z
?_wsopen@@YAHPB_WHHH@Z
?before@type_info@@QBEHABV1@@Z
?get_error_code@scheduler_resource_allocation_error@Concurrency@@QBEJXZ
?lock@critical_section@Concurrency@@QAEXXZ
?lock@reader_writer_lock@Concurrency@@QAEXXZ
?lock_read@reader_writer_lock@Concurrency@@QAEXXZ
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
?native_handle@critical_section@Concurrency@@QAEAAV12@XZ
?raw_name@type_info@@QBEPBDXZ
?reset@event@Concurrency@@QAEXXZ
?set@event@Concurrency@@QAEXXZ
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?set_terminate@@YAP6AXXZH@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZH@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?swprintf@@YAHPAGIPBGZZ
?swprintf@@YAHPA_WIPB_WZZ
?terminate@@YAXXZ
?try_lock@critical_section@Concurrency@@QAE_NXZ
?try_lock@reader_writer_lock@Concurrency@@QAE_NXZ
?try_lock_read@reader_writer_lock@Concurrency@@QAE_NXZ
?unexpected@@YAXXZ
?unlock@critical_section@Concurrency@@QAEXXZ
?unlock@reader_writer_lock@Concurrency@@QAEXXZ
?vswprintf@@YAHPA_WIPB_WPAD@Z
?wait@Concurrency@@YAXI@Z
?wait@event@Concurrency@@QAEII@Z
?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z
?what@exception@std@@UBEPBDXZ
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CRT_RTC_INIT
_CRT_RTC_INITW
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_Getdays
_Getmonths
_Gettnames
_HUGE
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_Strftime
_XcptFilter
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CppXcptFilter
__CxxCallUnwindDelDtor
__CxxCallUnwindDtor
__CxxCallUnwindStdDelDtor
__CxxCallUnwindVecDtor
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
__STRINGTOLD_L
__TypeMatch
___fls_getvalue@4
___fls_setvalue@8
___lc_codepage_func
___lc_collate_cp_func
___lc_handle_func
___mb_cur_max_func
___mb_cur_max_l_func
___setlc_active_func
___unguarded_readlc_active_add_func
__argc
__argv
__badioinfo
__clean_type_info_names_internal
__control87_2
__create_locale
__crtCompareStringA
__crtCompareStringW
__crtLCMapStringA
__crtLCMapStringW
__daylight
__dllonexit
__doserrno
__dstbias
__fpecode
__free_locale
__get_current_locale
__get_flsindex
__get_tlsindex
__getmainargs
__initenv
__iob_func
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__lconv
__lconv_init
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__commode
__p__daylight
__p__dstbias
__p__environ
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__wpgmptr
__pctype_func
__pioinfo
__pwctype_func
__pxcptinfoptrs
__report_gsfailure
__set_app_type
__set_flsgetvalue
__setlc_active
__setusermatherr
__strncnt
__swprintf_l
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__timezone
__toascii
__tzname
__unDName
__unDNameEx
__unDNameHelper
__uncaught_exception
__unguarded_readlc_active
__vswprintf_l
__wargv
__wcserror
__wcserror_s
__wcsncnt
__wgetmainargs
__winitenv
_abnormal_termination
_abs64
_access
_access_s
_acmdln
_aligned_free
_aligned_malloc
_aligned_msize
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_offset_recalloc
_aligned_realloc
_aligned_recalloc
_amsg_exit
_assert
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_beep
_beginthread
_beginthreadex
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_c_exit
_cabs
_callnewh
_calloc_crt
_cexit
_cgets
_cgets_s
_cgetws
_cgetws_s
_chdir
_chdrive
_chgsign
_chkesp
_chmod
_chsize
_chsize_s
_clearfp
_close
_commit
_commode
_configthreadlocale
_control87
_controlfp
_controlfp_s
_copysign
_cprintf
_cprintf_l
_cprintf_p

Sections

.text
Size: 709KB - Virtual size: 708KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
msvcr120.dll
.dll windows:6 windows x86 arch:x86

aa8d086deb6960b10f8791df466a5610

Code Sign

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:b0:11:af:0a:8b:d0:3b:9f:dd:00:01:00:00:00:b0
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/01/2013, 22:33

Not After

24/04/2014, 22:33

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:82:cf:f8:a2:0e:57:bd:cc:0a:76:cf:1e:4f:c9:43:8c:94:65:03:5e:34:db:a7:06:0b:42:ee:a6:9d:c2:88
Signer

Actual PE Digest

0a:82:cf:f8:a2:0e:57:bd:cc:0a:76:cf:1e:4f:c9:43:8c:94:65:03:5e:34:db:a7:06:0b:42:ee:a6:9d:c2:88

Digest Algorithm

sha256

PE Digest Matches

true

0a:82:cf:f8:a2:0e:57:bd:cc:0a:76:cf:1e:4f:c9:43:8c:94:65:03:5e:34:db:a7:06:0b:42:ee:a6:9d:c2:88
Signer

Actual PE Digest

0a:82:cf:f8:a2:0e:57:bd:cc:0a:76:cf:1e:4f:c9:43:8c:94:65:03:5e:34:db:a7:06:0b:42:ee:a6:9d:c2:88

Digest Algorithm

sha256

PE Digest Matches

true

0a:82:cf:f8:a2:0e:57:bd:cc:0a:76:cf:1e:4f:c9:43:8c:94:65:03:5e:34:db:a7:06:0b:42:ee:a6:9d:c2:88
Signer

Actual PE Digest

0a:82:cf:f8:a2:0e:57:bd:cc:0a:76:cf:1e:4f:c9:43:8c:94:65:03:5e:34:db:a7:06:0b:42:ee:a6:9d:c2:88

Digest Algorithm

sha256

PE Digest Matches

true

0a:82:cf:f8:a2:0e:57:bd:cc:0a:76:cf:1e:4f:c9:43:8c:94:65:03:5e:34:db:a7:06:0b:42:ee:a6:9d:c2:88
Signer

Actual PE Digest

0a:82:cf:f8:a2:0e:57:bd:cc:0a:76:cf:1e:4f:c9:43:8c:94:65:03:5e:34:db:a7:06:0b:42:ee:a6:9d:c2:88

Digest Algorithm

sha256

PE Digest Matches

true

3f:08:90:50:77:63:e4:04:ba:19:2c:b1:94:32:e7:d0:82:51:35:78
Signer

Actual PE Digest

3f:08:90:50:77:63:e4:04:ba:19:2c:b1:94:32:e7:d0:82:51:35:78

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

msvcr120.i386.pdb

Imports

kernel32

EncodePointer
DecodePointer
RaiseException
GetLastError
ExitProcess
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineA
GetCommandLineW
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
GetModuleFileNameA
SetLastError
GetCurrentThread
GetModuleFileNameW
IsProcessorFeaturePresent
GetStdHandle
WriteFile
FindClose
FindFirstFileExA
FindNextFileA
FindFirstFileExW
FindNextFileW
CloseHandle
CreateThread
ExitThread
ResumeThread
LoadLibraryExW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetDiskFreeSpaceA
GetLogicalDrives
SetErrorMode
Beep
Sleep
GetFullPathNameA
GetCurrentProcessId
GetFileAttributesExW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
MoveFileExW
RemoveDirectoryW
GetDriveTypeW
DeleteFileW
SetEnvironmentVariableA
SetCurrentDirectoryA
GetCurrentDirectoryA
SetCurrentDirectoryW
GetCurrentDirectoryW
SetEnvironmentVariableW
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
FreeLibrary
LoadLibraryExA
CreateProcessW
ReadFile
GetTempPathA
GetTempPathW
DuplicateHandle
GetCurrentProcess
GetSystemTimeAsFileTime
GetTimeZoneInformation
GetLocalTime
LocalFileTimeToFileTime
SetFileTime
SystemTimeToFileTime
SetLocalTime
InterlockedPopEntrySList
InterlockedFlushSList
QueryDepthSList
InterlockedPushEntrySList
CreateTimerQueue
SetEvent
WaitForSingleObjectEx
UnregisterWait
TlsGetValue
SignalObjectAndWait
TlsSetValue
SetThreadPriority
ChangeTimerQueueTimer
CreateTimerQueueTimer
GetNumaHighestNodeNumber
RegisterWaitForSingleObject
GetLogicalProcessorInformation
RtlCaptureStackBackTrace
GetThreadPriority
GetProcessAffinityMask
SetThreadAffinityMask
TlsAlloc
DeleteTimerQueueTimer
TlsFree
SwitchToThread
TryEnterCriticalSection
SetProcessAffinityMask
VirtualFree
GetVersionExW
VirtualAlloc
VirtualProtect
InitializeSListHead
ReleaseSemaphore
UnregisterWaitEx
LoadLibraryW
OutputDebugStringW
FreeLibraryAndExitThread
GetModuleHandleA
GetThreadTimes
CreateEventW
GetStringTypeW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
RtlUnwind
HeapFree
HeapAlloc
GetProcessHeap
HeapReAlloc
HeapSize
HeapQueryInformation
HeapValidate
HeapCompact
HeapWalk
GetSystemInfo
VirtualQuery
GetFileType
GetStartupInfoW
FileTimeToLocalFileTime
GetFileInformationByHandle
PeekNamedPipe
CreateFileW
GetConsoleMode
ReadConsoleW
GetConsoleCP
SetFilePointerEx
FlushFileBuffers
CreatePipe
SetStdHandle
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleInputA
SetConsoleMode
ReadConsoleInputW
WriteConsoleW
SetEndOfFile
LockFileEx
UnlockFileEx
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
TerminateProcess
GetTickCount
CreateSemaphoreW
SetConsoleCtrlHandler
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
OutputDebugStringA

Exports

Exports

$I10_OUTPUT
??0?$_SpinWait@$00@details@Concurrency@@QAE@P6AXXZ@Z
??0?$_SpinWait@$0A@@details@Concurrency@@QAE@P6AXXZ@Z
??0SchedulerPolicy@Concurrency@@QAA@IZZ
??0SchedulerPolicy@Concurrency@@QAE@ABV01@@Z
??0SchedulerPolicy@Concurrency@@QAE@XZ
??0_Cancellation_beacon@details@Concurrency@@QAE@XZ
??0_Condition_variable@details@Concurrency@@QAE@XZ
??0_Context@details@Concurrency@@QAE@PAVContext@2@@Z
??0_Interruption_exception@details@Concurrency@@QAE@PBD@Z
??0_Interruption_exception@details@Concurrency@@QAE@XZ
??0_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ
??0_NonReentrantPPLLock@details@Concurrency@@QAE@XZ
??0_ReaderWriterLock@details@Concurrency@@QAE@XZ
??0_ReentrantBlockingLock@details@Concurrency@@QAE@XZ
??0_ReentrantLock@details@Concurrency@@QAE@XZ
??0_ReentrantPPLLock@details@Concurrency@@QAE@XZ
??0_Scheduler@details@Concurrency@@QAE@PAVScheduler@2@@Z
??0_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z
??0_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@AAV123@@Z
??0_SpinLock@details@Concurrency@@QAE@ACJ@Z
??0_StructuredTaskCollection@details@Concurrency@@QAE@PAV_CancellationTokenState@12@@Z
??0_TaskCollection@details@Concurrency@@QAE@PAV_CancellationTokenState@12@@Z
??0_TaskCollection@details@Concurrency@@QAE@XZ
??0_Timer@details@Concurrency@@IAE@I_N@Z
??0__non_rtti_object@std@@QAE@ABV01@@Z
??0__non_rtti_object@std@@QAE@PBD@Z
??0bad_cast@std@@AAE@PBQBD@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??0bad_target@Concurrency@@QAE@PBD@Z
??0bad_target@Concurrency@@QAE@XZ
??0bad_typeid@std@@QAE@ABV01@@Z
??0bad_typeid@std@@QAE@PBD@Z
??0context_self_unblock@Concurrency@@QAE@PBD@Z
??0context_self_unblock@Concurrency@@QAE@XZ
??0context_unblock_unbalanced@Concurrency@@QAE@PBD@Z
??0context_unblock_unbalanced@Concurrency@@QAE@XZ
??0critical_section@Concurrency@@QAE@XZ
??0default_scheduler_exists@Concurrency@@QAE@PBD@Z
??0default_scheduler_exists@Concurrency@@QAE@XZ
??0event@Concurrency@@QAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??0improper_lock@Concurrency@@QAE@PBD@Z
??0improper_lock@Concurrency@@QAE@XZ
??0improper_scheduler_attach@Concurrency@@QAE@PBD@Z
??0improper_scheduler_attach@Concurrency@@QAE@XZ
??0improper_scheduler_detach@Concurrency@@QAE@PBD@Z
??0improper_scheduler_detach@Concurrency@@QAE@XZ
??0improper_scheduler_reference@Concurrency@@QAE@PBD@Z
??0improper_scheduler_reference@Concurrency@@QAE@XZ
??0invalid_link_target@Concurrency@@QAE@PBD@Z
??0invalid_link_target@Concurrency@@QAE@XZ
??0invalid_multiple_scheduling@Concurrency@@QAE@PBD@Z
??0invalid_multiple_scheduling@Concurrency@@QAE@XZ
??0invalid_operation@Concurrency@@QAE@PBD@Z
??0invalid_operation@Concurrency@@QAE@XZ
??0invalid_oversubscribe_operation@Concurrency@@QAE@PBD@Z
??0invalid_oversubscribe_operation@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_key@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_key@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_thread_specification@Concurrency@@QAE@XZ
??0invalid_scheduler_policy_value@Concurrency@@QAE@PBD@Z
??0invalid_scheduler_policy_value@Concurrency@@QAE@XZ
??0message_not_found@Concurrency@@QAE@PBD@Z
??0message_not_found@Concurrency@@QAE@XZ
??0missing_wait@Concurrency@@QAE@PBD@Z
??0missing_wait@Concurrency@@QAE@XZ
??0nested_scheduler_missing_detach@Concurrency@@QAE@PBD@Z
??0nested_scheduler_missing_detach@Concurrency@@QAE@XZ
??0operation_timed_out@Concurrency@@QAE@PBD@Z
??0operation_timed_out@Concurrency@@QAE@XZ
??0reader_writer_lock@Concurrency@@QAE@XZ
??0scheduler_not_attached@Concurrency@@QAE@PBD@Z
??0scheduler_not_attached@Concurrency@@QAE@XZ
??0scheduler_resource_allocation_error@Concurrency@@QAE@J@Z
??0scheduler_resource_allocation_error@Concurrency@@QAE@PBDJ@Z
??0scheduler_worker_creation_error@Concurrency@@QAE@J@Z
??0scheduler_worker_creation_error@Concurrency@@QAE@PBDJ@Z
??0scoped_lock@critical_section@Concurrency@@QAE@AAV12@@Z
??0scoped_lock@reader_writer_lock@Concurrency@@QAE@AAV12@@Z
??0scoped_lock_read@reader_writer_lock@Concurrency@@QAE@AAV12@@Z
??0task_canceled@Concurrency@@QAE@PBD@Z
??0task_canceled@Concurrency@@QAE@XZ
??0unsupported_os@Concurrency@@QAE@PBD@Z
??0unsupported_os@Concurrency@@QAE@XZ
??1SchedulerPolicy@Concurrency@@QAE@XZ
??1_Cancellation_beacon@details@Concurrency@@QAE@XZ
??1_Condition_variable@details@Concurrency@@QAE@XZ
??1_NonReentrantBlockingLock@details@Concurrency@@QAE@XZ
??1_ReentrantBlockingLock@details@Concurrency@@QAE@XZ
??1_Scoped_lock@_NonReentrantPPLLock@details@Concurrency@@QAE@XZ
??1_Scoped_lock@_ReentrantPPLLock@details@Concurrency@@QAE@XZ
??1_SpinLock@details@Concurrency@@QAE@XZ
??1_StructuredTaskCollection@details@Concurrency@@QAE@XZ
??1_TaskCollection@details@Concurrency@@QAE@XZ
??1_Timer@details@Concurrency@@MAE@XZ
??1__non_rtti_object@std@@UAE@XZ
??1bad_cast@std@@UAE@XZ
??1bad_typeid@std@@UAE@XZ
??1critical_section@Concurrency@@QAE@XZ
??1event@Concurrency@@QAE@XZ
??1exception@std@@UAE@XZ
??1reader_writer_lock@Concurrency@@QAE@XZ
??1scoped_lock@critical_section@Concurrency@@QAE@XZ
??1scoped_lock@reader_writer_lock@Concurrency@@QAE@XZ
??1scoped_lock_read@reader_writer_lock@Concurrency@@QAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??2@YAPAXIHPBDH@Z
??3@YAXPAX@Z
??3@YAXPAXHPBDH@Z
??4?$_SpinWait@$00@details@Concurrency@@QAEAAV012@ABV012@@Z
??4?$_SpinWait@$0A@@details@Concurrency@@QAEAAV012@ABV012@@Z
??4SchedulerPolicy@Concurrency@@QAEAAV01@ABV01@@Z
??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z
??4bad_cast@std@@QAEAAV01@ABV01@@Z
??4bad_typeid@std@@QAEAAV01@ABV01@@Z
??4exception@std@@QAEAAV01@ABV01@@Z
??8type_info@@QBE_NABV0@@Z
??9type_info@@QBE_NABV0@@Z
??_7__non_rtti_object@std@@6B@
??_7bad_cast@std@@6B@
??_7bad_typeid@std@@6B@
??_7exception@std@@6B@
??_F?$_SpinWait@$00@details@Concurrency@@QAEXXZ
??_F?$_SpinWait@$0A@@details@Concurrency@@QAEXXZ
??_F_Context@details@Concurrency@@QAEXXZ
??_F_Scheduler@details@Concurrency@@QAEXXZ
??_Fbad_cast@std@@QAEXXZ
??_Fbad_typeid@std@@QAEXXZ
??_U@YAPAXI@Z
??_U@YAPAXIHPBDH@Z
??_V@YAXPAX@Z
??_V@YAXPAXHPBDH@Z
?Alloc@Concurrency@@YAPAXI@Z
?Block@Context@Concurrency@@SAXXZ
?CaptureCallstack@platform@details@Concurrency@@YAIPAPAXII@Z
?Create@CurrentScheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z
?Create@Scheduler@Concurrency@@SAPAV12@ABVSchedulerPolicy@2@@Z
?CreateResourceManager@Concurrency@@YAPAUIResourceManager@1@XZ
?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@AAVlocation@2@@Z
?CreateScheduleGroup@CurrentScheduler@Concurrency@@SAPAVScheduleGroup@2@XZ
?CurrentContext@Context@Concurrency@@SAPAV12@XZ
?Detach@CurrentScheduler@Concurrency@@SAXXZ
?DisableTracing@Concurrency@@YAJXZ
?EnableTracing@Concurrency@@YAJXZ
?Free@Concurrency@@YAXPAX@Z
?Get@CurrentScheduler@Concurrency@@SAPAVScheduler@2@XZ
?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ
?GetExecutionContextId@Concurrency@@YAIXZ
?GetNumberOfVirtualProcessors@CurrentScheduler@Concurrency@@SAIXZ
?GetOSVersion@Concurrency@@YA?AW4OSVersion@IResourceManager@1@XZ
?GetPolicy@CurrentScheduler@Concurrency@@SA?AVSchedulerPolicy@2@XZ
?GetPolicyValue@SchedulerPolicy@Concurrency@@QBEIW4PolicyElementKey@2@@Z
?GetProcessorCount@Concurrency@@YAIXZ
?GetProcessorNodeCount@Concurrency@@YAIXZ
?GetSchedulerId@Concurrency@@YAIXZ
?GetSharedTimerQueue@details@Concurrency@@YAPAXXZ
?Id@Context@Concurrency@@SAIXZ
?Id@CurrentScheduler@Concurrency@@SAIXZ
?IsAvailableLocation@CurrentScheduler@Concurrency@@SA_NABVlocation@2@@Z
?IsCurrentTaskCollectionCanceling@Context@Concurrency@@SA_NXZ
?Log2@details@Concurrency@@YAKI@Z
?Oversubscribe@Context@Concurrency@@SAX_N@Z
?RegisterShutdownEvent@CurrentScheduler@Concurrency@@SAXPAX@Z
?ResetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXXZ
?ScheduleGroupId@Context@Concurrency@@SAIXZ
?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0@Z
?ScheduleTask@CurrentScheduler@Concurrency@@SAXP6AXPAX@Z0AAVlocation@2@@Z
?SetConcurrencyLimits@SchedulerPolicy@Concurrency@@QAEXII@Z
?SetDefaultSchedulerPolicy@Scheduler@Concurrency@@SAXABVSchedulerPolicy@2@@Z
?SetPolicyValue@SchedulerPolicy@Concurrency@@QAEIW4PolicyElementKey@2@I@Z
?VirtualProcessorId@Context@Concurrency@@SAIXZ
?Yield@Context@Concurrency@@SAXXZ
?_Abort@_StructuredTaskCollection@details@Concurrency@@AAEXXZ
?_Acquire@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Acquire@_NonReentrantPPLLock@details@Concurrency@@QAEXPAX@Z
?_Acquire@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Acquire@_ReentrantLock@details@Concurrency@@QAEXXZ
?_Acquire@_ReentrantPPLLock@details@Concurrency@@QAEXPAX@Z
?_AcquireRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_AcquireWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_Cancel@_StructuredTaskCollection@details@Concurrency@@QAEXXZ
?_Cancel@_TaskCollection@details@Concurrency@@QAEXXZ
?_CheckTaskCollection@_UnrealizedChore@details@Concurrency@@IAEXXZ
?_CleanupToken@_StructuredTaskCollection@details@Concurrency@@AAEXXZ
?_ConcRT_CoreAssert@details@Concurrency@@YAXPBD0H@Z
?_ConcRT_Trace@details@Concurrency@@YAXHPB_WZZ
?_Confirm_cancel@_Cancellation_beacon@details@Concurrency@@QAE_NXZ
?_Copy_str@exception@std@@AAEXPBD@Z
?_CurrentContext@_Context@details@Concurrency@@SA?AV123@XZ
?_Current_node@location@Concurrency@@SA?AV12@XZ
?_Destroy@_AsyncTaskCollection@details@Concurrency@@EAEXXZ
?_DoYield@?$_SpinWait@$00@details@Concurrency@@IAEXXZ
?_DoYield@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ
?_Get@_CurrentScheduler@details@Concurrency@@SA?AV_Scheduler@23@XZ
?_GetConcRTTraceInfo@Concurrency@@YAPBU_CONCRT_TRACE_INFO@details@1@XZ
?_GetConcurrency@details@Concurrency@@YAIXZ
?_GetCurrentInlineDepth@_StackGuard@details@Concurrency@@CAAAIXZ
?_GetNumberOfVirtualProcessors@_CurrentScheduler@details@Concurrency@@SAIXZ
?_GetScheduler@_Scheduler@details@Concurrency@@QAEPAVScheduler@3@XZ
?_Id@_CurrentScheduler@details@Concurrency@@SAIXZ
?_IsCanceling@_StructuredTaskCollection@details@Concurrency@@QAE_NXZ
?_IsCanceling@_TaskCollection@details@Concurrency@@QAE_NXZ
?_IsSynchronouslyBlocked@_Context@details@Concurrency@@QBE_NXZ
?_Name_base@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Name_base_internal@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_NewCollection@_AsyncTaskCollection@details@Concurrency@@SAPAV123@PAV_CancellationTokenState@23@@Z
?_NumberOfSpins@?$_SpinWait@$00@details@Concurrency@@IAEKXZ
?_NumberOfSpins@?$_SpinWait@$0A@@details@Concurrency@@IAEKXZ
?_Oversubscribe@_Context@details@Concurrency@@SAX_N@Z
?_Reference@_Scheduler@details@Concurrency@@QAEIXZ
?_Release@_NonReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Release@_NonReentrantPPLLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantBlockingLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantLock@details@Concurrency@@QAEXXZ
?_Release@_ReentrantPPLLock@details@Concurrency@@QAEXXZ
?_Release@_Scheduler@details@Concurrency@@QAEIXZ
?_ReleaseRead@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_ReleaseWrite@_ReaderWriterLock@details@Concurrency@@QAEXXZ
?_ReportUnobservedException@details@Concurrency@@YAXXZ
?_Reset@?$_SpinWait@$00@details@Concurrency@@IAEXXZ
?_Reset@?$_SpinWait@$0A@@details@Concurrency@@IAEXXZ
?_RunAndWait@_StructuredTaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z
?_RunAndWait@_TaskCollection@details@Concurrency@@QAG?AW4_TaskCollectionStatus@23@PAV_UnrealizedChore@23@@Z
?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z
?_Schedule@_StructuredTaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@PAVlocation@3@@Z
?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@@Z
?_Schedule@_TaskCollection@details@Concurrency@@QAEXPAV_UnrealizedChore@23@PAVlocation@3@@Z
?_ScheduleTask@_CurrentScheduler@details@Concurrency@@SAXP6AXPAX@Z0@Z
?_SetSpinCount@?$_SpinWait@$00@details@Concurrency@@QAEXI@Z
?_SetSpinCount@?$_SpinWait@$0A@@details@Concurrency@@QAEXI@Z
?_SetUnobservedExceptionHandler@details@Concurrency@@YAXP6AXXZ@Z
?_ShouldSpinAgain@?$_SpinWait@$00@details@Concurrency@@IAE_NXZ
?_ShouldSpinAgain@?$_SpinWait@$0A@@details@Concurrency@@IAE_NXZ
?_SpinOnce@?$_SpinWait@$00@details@Concurrency@@QAE_NXZ
?_SpinOnce@?$_SpinWait@$0A@@details@Concurrency@@QAE_NXZ
?_SpinYield@Context@Concurrency@@SAXXZ
?_Start@_Timer@details@Concurrency@@IAEXXZ
?_Stop@_Timer@details@Concurrency@@IAEXXZ
?_Tidy@exception@std@@AAEXXZ
?_Trace_agents@Concurrency@@YAXW4Agents_EventType@1@_JZZ
?_Trace_ppl_function@Concurrency@@YAXABU_GUID@@EW4ConcRT_EventType@1@@Z
?_TryAcquire@_NonReentrantBlockingLock@details@Concurrency@@QAE_NXZ
?_TryAcquire@_ReentrantBlockingLock@details@Concurrency@@QAE_NXZ
?_TryAcquire@_ReentrantLock@details@Concurrency@@QAE_NXZ
?_TryAcquireWrite@_ReaderWriterLock@details@Concurrency@@QAE_NXZ
?_Type_info_dtor@type_info@@CAXPAV1@@Z
?_Type_info_dtor_internal@type_info@@CAXPAV1@@Z
?_UnderlyingYield@details@Concurrency@@YAXXZ
?_ValidateExecute@@YAHP6GHXZ@Z
?_ValidateRead@@YAHPBXI@Z
?_ValidateWrite@@YAHPAXI@Z
?_Value@_SpinCount@details@Concurrency@@SAIXZ
?_Yield@_Context@details@Concurrency@@SAXXZ
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCompare@@YA_NPBX0@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrCurrentException@@YAXPAX@Z
?__ExceptionPtrDestroy@@YAXPAX@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?__ExceptionPtrSwap@@YAXPAX0@Z
?__ExceptionPtrToBool@@YA_NPBX@Z
?_inconsistency@@YAXXZ
?_invalid_parameter@@YAXPBG00II@Z
?_is_exception_typeof@@YAHABVtype_info@@PAU_EXCEPTION_POINTERS@@@Z
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
?_open@@YAHPBDHH@Z
?_query_new_handler@@YAP6AHI@ZXZ
?_query_new_mode@@YAHXZ
?_set_new_handler@@YAP6AHI@ZH@Z
?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z
?_set_new_mode@@YAHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?_sopen@@YAHPBDHHH@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?_wopen@@YAHPB_WHH@Z
?_wsopen@@YAHPB_WHHH@Z
?before@type_info@@QBE_NABV1@@Z
?current@location@Concurrency@@SA?AV12@XZ
?from_numa_node@location@Concurrency@@SA?AV12@G@Z
?get_error_code@scheduler_resource_allocation_error@Concurrency@@QBEJXZ
?lock@critical_section@Concurrency@@QAEXXZ
?lock@reader_writer_lock@Concurrency@@QAEXXZ
?lock_read@reader_writer_lock@Concurrency@@QAEXXZ
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
?native_handle@critical_section@Concurrency@@QAEAAV12@XZ
?notify_all@_Condition_variable@details@Concurrency@@QAEXXZ
?notify_one@_Condition_variable@details@Concurrency@@QAEXXZ
?raw_name@type_info@@QBEPBDXZ
?reset@event@Concurrency@@QAEXXZ
?set@event@Concurrency@@QAEXXZ
?set_new_handler@@YAP6AXXZP6AXXZ@Z
?set_task_execution_resources@Concurrency@@YAXGPAU_GROUP_AFFINITY@@@Z
?set_task_execution_resources@Concurrency@@YAXK@Z
?set_terminate@@YAP6AXXZH@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZH@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?swprintf@@YAHPAGIPBGZZ
?swprintf@@YAHPA_WIPB_WZZ
?terminate@@YAXXZ
?try_lock@critical_section@Concurrency@@QAE_NXZ
?try_lock@reader_writer_lock@Concurrency@@QAE_NXZ
?try_lock_for@critical_section@Concurrency@@QAE_NI@Z
?try_lock_read@reader_writer_lock@Concurrency@@QAE_NXZ
?unexpected@@YAXXZ
?unlock@critical_section@Concurrency@@QAEXXZ
?unlock@reader_writer_lock@Concurrency@@QAEXXZ
?vswprintf@@YAHPA_WIPB_WPAD@Z
?wait@Concurrency@@YAXI@Z
?wait@_Condition_variable@details@Concurrency@@QAEXAAVcritical_section@3@@Z
?wait@event@Concurrency@@QAEII@Z
?wait_for@_Condition_variable@details@Concurrency@@QAE_NAAVcritical_section@3@I@Z
?wait_for_multiple@event@Concurrency@@SAIPAPAV12@I_NI@Z
?what@exception@std@@UBEPBDXZ
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CRT_RTC_INIT
_CRT_RTC_INITW
_Cbuild
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FCbuild
_FindAndUnlinkFrame
_Getdays
_Getmonths
_Gettnames
_HUGE
_IsExceptionObjectToBeDestroyed
_LCbuild
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_SetWinRTOutOfMemoryExceptionCallback
_Strftime
_W_Getdays
_W_Getmonths
_W_Gettnames
_Wcsftime
_XcptFilter
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CppXcptFilter
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__GetPlatformExceptionInfo
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
__STRINGTOLD_L
__TypeMatch
___lc_codepage_func
___lc_collate_cp_func
___lc_locale_name_func
___mb_cur_max_func
___mb_cur_max_l_func
___setlc_active_func
___unguarded_readlc_active_add_func
__argc
__argv
__badioinfo
__clean_type_info_names_internal
__control87_2
__create_locale
__crtCompareStringA
__crtCompareStringEx
__crtCompareStringW
__crtCreateEventExW
__crtCreateSemaphoreExW
__crtCreateSymbolicLinkW
__crtEnumSystemLocalesEx
__crtFlsAlloc
__crtFlsFree
__crtFlsGetValue
__crtFlsSetValue
__crtGetDateFormatEx
__crtGetFileInformationByHandleEx
__crtGetLocaleInfoEx
__crtGetShowWindowMode
__crtGetTickCount64
__crtGetTimeFormatEx
__crtGetUserDefaultLocaleName
__crtInitializeCriticalSectionEx
__crtIsPackagedApp
__crtIsValidLocaleName
__crtLCMapStringA
__crtLCMapStringEx
__crtLCMapStringW
__crtSetFileInformationByHandle
__crtSetThreadStackGuarantee
__crtSetUnhandledExceptionFilter
__crtSleep
__crtTerminateProcess
__crtUnhandledException
__daylight
__dllonexit
__doserrno
__dstbias
__fpecode
__free_locale
__get_current_locale
__get_flsindex
__get_tlsindex
__getmainargs
__initenv
__iob_func
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__lconv
__lconv_init
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__commode
__p__daylight
__p__dstbias
__p__environ
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__wpgmptr
__pctype_func
__pioinfo
__pwctype_func
__pxcptinfoptrs
__report_gsfailure
__set_app_type
__setlc_active

Sections

.text
Size: 880KB - Virtual size: 880KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nfcore.dll
.dll windows:5 windows x86 arch:x86

0035a223c7623f1bf371a2327c3faf5a

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

44:b2:95:96:0c:eb:fb:57:48:ab:24:de:f2:ff:d3:f5:3a:ce:f5:b3:28:d9:d3:00:90:8e:52:ac:fe:00:40:70
Signer

Actual PE Digest

44:b2:95:96:0c:eb:fb:57:48:ab:24:de:f2:ff:d3:f5:3a:ce:f5:b3:28:d9:d3:00:90:8e:52:ac:fe:00:40:70

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\nfcore.pdb

Imports

kernel32

GetSystemDirectoryW
WaitForSingleObject
GetCurrentProcessId
QueueUserWorkItem
GetTickCount
InitializeCriticalSection
CopyFileW
EnterCriticalSection
MapViewOfFile
CreateFileMappingW
SetFilePointerEx
CloseHandle
DeleteFileW
GetNativeSystemInfo
DisableThreadLibraryCalls
GetCurrentThreadId
UnmapViewOfFile
DeleteCriticalSection
SystemTimeToTzSpecificLocalTime
LeaveCriticalSection
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
GetEnvironmentVariableA
CompareFileTime
SetConsoleMode
ReadConsoleA
ConvertFiberToThread
ConvertThreadToFiberEx
GetEnvironmentVariableW
SwitchToFiber
DeleteFiber
CreateFiberEx
VirtualFree
InterlockedCompareExchange64
InterlockedExchangeAdd
AcquireSRWLockShared
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
InitializeSRWLock
WriteConsoleW
SetStdHandle
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
CreateFileW
WriteFile
ReadFile
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
GetFileType
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
SetConsoleCtrlHandler
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
GetLastError
FormatMessageW
WideCharToMultiByte
MultiByteToWideChar
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
OpenProcess
InterlockedIncrement
InterlockedDecrement
GetTempFileNameW
SetEvent
CreateMutexA
CreateEventA
QueryPerformanceFrequency
FindClose
CreateDirectoryW
GetFileAttributesW
FindFirstFileW
FindNextFileW
FreeLibrary
LoadLibraryA
ProcessIdToSessionId
GetShortPathNameW
CreateProcessW
ExpandEnvironmentStringsW
GetVersion
GetFileAttributesExW
QueueUserAPC
SleepEx
CreateMutexW
ReleaseMutex
LocalFree
FileTimeToSystemTime
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
HeapFree
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
GetVersionExW
HeapValidate
HeapSize
Sleep
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
CreateFileA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSize
GetProcessHeap
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
GetVolumeInformationW
GetLogicalDrives
DeviceIoControl
GetOverlappedResult
ResetEvent
WaitForMultipleObjects
GetModuleHandleA
GetDriveTypeW
QueryDosDeviceW
CancelIo
TerminateThread
lstrcpynW
GetDriveTypeA
GetVolumeInformationA
SetFileAttributesW
LoadLibraryExW
GetExitCodeProcess
GetModuleFileNameA
GetFileSizeEx
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
lstrlenW
RaiseException
MoveFileExW
OpenMutexW
GetDiskFreeSpaceExW
OpenFileMappingW
GetComputerNameW
GetPrivateProfileStringA
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
ExitProcess
GetCurrentDirectoryW

advapi32

RegCreateKeyExW
OpenProcessToken
GetTokenInformation
LookupAccountSidA
LookupAccountSidW
RegCloseKey
RegEnumKeyExW
RegOpenKeyExW
RegQueryValueExW
RevertToSelf
ImpersonateLoggedOnUser
DuplicateTokenEx
ConvertStringSecurityDescriptorToSecurityDescriptorW
AdjustTokenPrivileges
LookupPrivilegeValueA
RegOpenKeyExA
RegQueryValueExA
RegSetValueExA
CreateServiceW
DeleteService
OpenSCManagerA
OpenServiceW
ChangeServiceConfigW
OpenSCManagerW
CloseServiceHandle
OpenServiceA
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
SetSecurityDescriptorDacl
SetFileSecurityW
ConvertSidToStringSidA
ConvertSidToStringSidW
InitializeSecurityDescriptor
RegSetValueExW
SetEntriesInAclW
AllocateAndInitializeSid
QueryServiceStatus
StartServiceA

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExA
SHCreateDirectoryExW

shlwapi

PathIsDirectoryW
StrToInt64ExA
SHGetValueW
SHSetValueW
PathFindFileNameA
SHSetValueA
wvnsprintfA
wvnsprintfW
StrStrIA
wnsprintfA
StrStrA
PathFindFileNameW
StrCmpNA
PathFileExistsW
wnsprintfW
StrCmpNIA
StrCmpIW
StrStrIW
PathIsNetworkPathW
PathMatchSpecW
PathAppendW
SHDeleteValueW
StrToIntExA
SHDeleteValueA
PathAppendA
PathFileExistsA

ws2_32

recv
setsockopt
htonl
ntohs
ntohl
WSACleanup
WSAGetLastError
htons
inet_ntoa
inet_addr
WSAAddressToStringA
WSAWaitForMultipleEvents
connect
socket
WSASetLastError
WSACreateEvent
WSACloseEvent
closesocket
WSAIoctl
bind
gethostbyname
gethostname
send
gethostbyaddr
getservbyport
getservbyname
ioctlsocket
getsockname
getsockopt
WSAStartup
sendto
recvfrom
freeaddrinfo
getaddrinfo
select
accept
listen
shutdown
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
getpeername
__WSAFDIsSet

crypt32

CertOpenSystemStoreW
PFXExportCertStoreEx
CertAddCertificateContextToStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateChain
CertGetCertificateChain
CertOpenSystemStoreA
CertAddEncodedCertificateToStore
CertSetCertificateContextProperty
CertFreeCertificateContext
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertVerifyCertificateChainPolicy
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertGetCertificateContextProperty

psapi

GetModuleFileNameExW

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

netapi32

Netbios

iphlpapi

GetAdaptersInfo
GetAdaptersAddresses

wldap32

ord219
ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord145
ord46
ord14
ord216
ord27
ord26
ord117
ord41
ord208

bcrypt

BCryptGenRandom

user32

CharUpperW
wsprintfW
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
wsprintfA

ole32

CoCreateGuid
CoUninitialize
CoInitialize
CoSetProxyBlanket
CoCreateInstance

oleaut32

SysFreeString
SysAllocString

Exports

Exports

AddRule
ConfigFileUpdated
ConnectLogPolicyHandler
DNSFilterPolicyHandlerEx
DeleteRules
FTPFilterPolicyHandlerEx
FlowCtrlPolicyHandler
FlowStatPolicyHandler
FlushRules
HttpCtrlPolicyHandlerEx
MailCtrlPolicyHandlerEx
MailMonitorPolicyHandlerEx
NF_Install
NF_ProtocolFilterFree
NF_ProtocolFilterInit
NF_Uninstall
NetBIOSFilterPolicyHandlerEx
RegisterHtmlPureTextAnalyzeHandler
RegisterHttpHeaderAnalyzeHandler
RegisterTCPConnectedHandler
RegisterTCPConnectedHandler2
RegisterUrlAccessControlHandler
RegisterWebsiteVisitNotify
UnRegisterHtmlPureTextAnalyzeHandler
UnRegisterHttpHeaderAnalyzeHandler
UpdateHttpPOSTCtrlParameter
UpdateMailCtrlParameter
WebMonitorPolicyHandlerEx

Sections

.text
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 66KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 179KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nss/certutil.exe
.exe windows:5 windows x86 arch:x86

d5676b0ac913e7865ef205cabe575fef

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:3a:37:a5:1c:46:82:3b:9b:27:ad:e5:db:bf:33:f1
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

18/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

Issuer

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Not Before

15/08/2017, 07:55

Not After

15/08/2028, 07:55

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/04/2015, 00:58

Not After

08/04/2025, 00:58

Subject

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4a:0e:67:ad:cc:4a:44:78:1c:78:e4:88:d9:5b:3e:f1:05:c5:c0:a0:6b:b8:8a:fd:08:ff:6e:2f:70:7c:d5:6b
Signer

Actual PE Digest

4a:0e:67:ad:cc:4a:44:78:1c:78:e4:88:d9:5b:3e:f1:05:c5:c0:a0:6b:b8:8a:fd:08:ff:6e:2f:70:7c:d5:6b

Digest Algorithm

sha256

PE Digest Matches

true

4a:0e:67:ad:cc:4a:44:78:1c:78:e4:88:d9:5b:3e:f1:05:c5:c0:a0:6b:b8:8a:fd:08:ff:6e:2f:70:7c:d5:6b
Signer

Actual PE Digest

4a:0e:67:ad:cc:4a:44:78:1c:78:e4:88:d9:5b:3e:f1:05:c5:c0:a0:6b:b8:8a:fd:08:ff:6e:2f:70:7c:d5:6b

Digest Algorithm

sha256

PE Digest Matches

true

e0:d7:5a:12:b8:86:39:0c:26:e1:8f:ff:85:17:ba:1e:2f:c7:05:28
Signer

Actual PE Digest

e0:d7:5a:12:b8:86:39:0c:26:e1:8f:ff:85:17:ba:1e:2f:c7:05:28

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

nssutil3

SECITEM_ZfreeItem_Util
PORT_Free_Util
PORT_Strdup_Util
PORT_SetError_Util
SECOID_AddEntry_Util
CERT_GenTime2FormattedAscii_Util
DER_GeneralizedTimeToTime_Util
DER_UTCTimeToTime_Util
ATOB_ConvertAsciiToItem_Util
NSS_Get_SEC_GeneralizedTimeTemplate_Util
SEC_QuickDERDecodeItem_Util
SECOID_FindOID_Util
SECITEM_ReallocItemV2
NSS_Get_SECOID_AlgorithmIDTemplate_Util
DER_GetInteger_Util
SEC_ASN1Decode_Util
ATOB_AsciiToData_Util
DER_AsciiToTime_Util
SEC_ASN1DecodeItem_Util
SECOID_GetAlgorithmTag_Util
SECOID_SetAlgorithmID_Util
SECOID_FindOIDTag_Util
BTOA_ConvertItemToAscii_Util
BTOA_DataToAscii_Util
NSS_Get_SEC_ObjectIDTemplate_Util
SECITEM_CompareItem_Util
SECITEM_AllocItem_Util
PORT_ZAlloc_Util
PORT_Realloc_Util
PORT_Alloc_Util
NSS_Get_SEC_IA5StringTemplate_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeItem_Util
SEC_StringToOID
SECOID_FindOIDByTag_Util
SECITEM_FreeItem_Util
SECITEM_CopyItem_Util
PORT_ArenaStrdup_Util
PORT_ArenaRelease_Util
PORT_ArenaMark_Util
PORT_ArenaGrow_Util
PORT_ArenaZAlloc_Util
PORT_ArenaAlloc_Util
PORT_FreeArena_Util
PORT_NewArena_Util
PORT_GetError_Util

smime3

CERT_DecodeCertFromPackage

nss3

CERT_DestroyCertificateRequest
CERT_StartCertificateRequestAttributes
CERT_FinishCertificateRequestAttributes
CERT_GetCertificateRequestExtensions
CERT_ExtractPublicKey
CERT_GetDefaultCertDB
CERT_FindCertByDERCert
CERT_FindCertByNicknameOrEmailAddr
CERT_FindCertByNicknameOrEmailAddrCX
CERT_VerifySignedDataWithPublicKeyInfo
CERT_VerifyCertificate
CERT_GetCertEmailAddress
CERT_GetCommonName
CERT_GetCountryName
CERT_GetStateName
PK11_IsLoggedIn
CERT_ChangeCertTrust
CERT_StartCertExtensions
CERT_FinishExtensions
CERT_MergeExtensions
CERT_CertChainFromCert
CERT_DestroyCertificateList
CERT_DecodeTrustString
CERT_SaveSMimeProfile
CERT_DestroyCertList
CERT_CreateSubjectCertList
SEC_DerSignDataWithAlgorithmID
SEC_GetSignatureAlgorithmOidTag
SEC_CreateSignatureAlgorithmParameters
SEC_DeletePermCertificate
NSS_Initialize
NSS_InitWithMerge
NSS_Shutdown
PK11_RandomUpdate
PK11_GenerateKeyPairWithOpFlags
NSS_Get_SECKEY_RSAPSSParamsTemplate
CERT_CreateCertificateRequest
SECKEY_ExtractPublicKey
SEC_PKCS5IsAlgorithmPBEAlgTag
CERT_NameToAscii
CERT_GetOidString
CERT_Hexify
CERT_NewTempCertificate
CERT_GetCertTrust
CERT_DestroyOidSequence
CERT_DecodeBasicConstraintValue
CERT_DecodeAuthKeyID
CERT_DecodeCRLDistributionPoints
CERT_DecodeOidSequence
CERT_DecodeAltNameExtension
CERT_DecodeNameConstraintsExtension
CERT_DecodeAuthInfoAccessExtension
CERT_GetNextGeneralName
CERT_GetNextNameConstraint
PK11_GetFirstSafe
PK11_GetNextSafe
PK11_CheckUserPassword
PK11_ChangePW
PK11_ProtectedAuthenticationPath
PK11_IsFIPS
PK11_FindCertInSlot
PK11_HasAttributeSet
PK11_HashBuf
PK11_GetAllSlotsForCert
CERT_DestroyCertificatePoliciesExtension
CERT_DecodeUserNotice
CERT_DecodePrivKeyUsagePeriodExtension
CERT_DestroyUserNotice
CERT_DestroyCertificate
CERT_CreateCertificate
CERT_DestroyValidity
CERT_CreateValidity
PK11_GetLowLevelKeyIDForPrivateKey
PK11_ReadRawAttribute
PK11_ListCertsInSlot
PK11_ListCerts
PK11_ImportCert
PK11_GetCertFromPrivateKey
PK11_FindCertFromNickname
PK11_FindCertsFromEmailAddress
PK11_ListPrivateKeysInSlot
PK11_ListPrivKeysInSlot
PK11_FindKeyByDERCert
PK11_FindKeyByAnyCert
__PK11_SetCertificateNickname
PK11_GetPrivateKeyNickname
PK11_DeleteTokenCertAndKey
PK11_DestroyMergeLog
PK11_CreateMergeLog
PK11_MergeTokens
SECMOD_CloseUserDB
SECMOD_OpenUserDB
PK11_GetAllTokens
PK11_IsPresent
PK11_NeedUserInit
PK11_IsRemovable
PK11_IsFriendly
PK11_NeedLogin
PK11_GetSlotName
PK11_GetTokenURI
PK11_GetTokenName
PK11_IsInternal
PK11_FindSlotByName
PK11_Authenticate
PK11_ResetToken
PK11_SetPasswordFunc
PK11_InitPin
PK11_GetInternalKeySlot
PK11_FreeSlot
PK11_FreeSlotList
SECKEY_DestroyPrivateKeyList
SECKEY_GetPrivateKeyType
SECKEY_DestroyPublicKey
SECKEY_DestroyPrivateKey
SECKEY_CreateSubjectPublicKeyInfo
SECKEY_DestroySubjectPublicKeyInfo
NSS_Get_CERT_SignedDataTemplate
NSS_Get_CERT_CertificateTemplate
NSS_Get_CERT_CertificateRequestTemplate
CERT_EncodeNameConstraintsExtension
CERT_EncodeNoticeReference
CERT_EncodeCertPoliciesExtension
CERT_EncodeUserNotice
CERT_EncodeInfoAccessExtension
CERT_EncodePolicyMappingExtension
CERT_EncodeInhibitAnyExtension
CERT_EncodePolicyConstraintsExtension
CERT_GetGeneralNameTypeFromString
CERT_EncodeCRLDistributionPoints
CERT_EncodeAuthKeyID
CERT_EncodeBasicConstraintValue
CERT_EncodeAltNameExtension
CERT_EncodeAndAddBitStrExtension
CERT_AddExtensionByOID
CERT_AddExtension
CERT_EncodeSubjectKeyID
CERT_DestroyName
CERT_CopyName
CERT_CopyRDN
CERT_AsciiToName
CERT_GetOrgName

libplc4

PL_strcmp
PL_GetNextOpt
PL_DestroyOptState
PL_CreateLongOptState
PL_strfree
PL_strdup
PL_strlen
PL_strncasecmp
PL_strndup

libplds4

PL_ArenaFinish

libnspr4

PR_NetAddrToString
PR_GetEnvSecure
PR_FormatTime
PR_ErrorToName
PR_GetErrorText
PR_GetErrorTextLength
PR_GetOpenFileInfo
PR_Read
PR_fprintf
PR_smprintf_free
PR_smprintf
PR_Cleanup
PR_Init
PR_Write
PR_GetSpecialFD
PR_GMTParameters
PR_ImplodeTime
PR_ExplodeTime
PR_Now
PR_ErrorToString
PR_GetOSError
PR_GetError
PR_StringToNetAddr
PR_snprintf
PR_Close
PR_Open
PR_IsNetAddrType

kernel32

SetConsoleMode
ReadConsoleInputA
SetEndOfFile
CreateFileW
HeapSize
LoadLibraryW
OutputDebugStringW
LCMapStringW
GetStringTypeW
ReadConsoleW
ReadFile
WriteConsoleW
SetFilePointerEx
SetStdHandle
HeapReAlloc
HeapAlloc
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetProcessHeap
LoadLibraryExW
GetModuleFileNameW
RtlUnwind
CloseHandle
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThreadId
SetLastError
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
InterlockedIncrement
GetStartupInfoW
GetFileType
GetStdHandle
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
WriteFile
FlushFileBuffers
Sleep
HeapFree
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCommandLineA
MultiByteToWideChar
AreFileApisANSI
GetProcAddress
GetModuleHandleExW
ExitProcess
InterlockedDecrement
GetLastError
DecodePointer
EncodePointer
IsProcessorFeaturePresent
IsDebuggerPresent
LeaveCriticalSection
EnterCriticalSection

Sections

.text
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nss/freebl3.dll
.dll windows:6 windows x86 arch:x86

7ae99d7c61a7f5dfbd6bc3b376405341

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:3a:37:a5:1c:46:82:3b:9b:27:ad:e5:db:bf:33:f1
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

18/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

Issuer

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Not Before

15/08/2017, 07:55

Not After

15/08/2028, 07:55

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/04/2015, 00:58

Not After

08/04/2025, 00:58

Subject

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

46:5a:2d:6d:e5:2a:12:ba:49:37:10:53:d5:67:fc:b8:a3:5e:5f:a7:26:0f:d3:2b:51:b0:8c:9b:b6:21:3c:2c
Signer

Actual PE Digest

46:5a:2d:6d:e5:2a:12:ba:49:37:10:53:d5:67:fc:b8:a3:5e:5f:a7:26:0f:d3:2b:51:b0:8c:9b:b6:21:3c:2c

Digest Algorithm

sha256

PE Digest Matches

true

46:5a:2d:6d:e5:2a:12:ba:49:37:10:53:d5:67:fc:b8:a3:5e:5f:a7:26:0f:d3:2b:51:b0:8c:9b:b6:21:3c:2c
Signer

Actual PE Digest

46:5a:2d:6d:e5:2a:12:ba:49:37:10:53:d5:67:fc:b8:a3:5e:5f:a7:26:0f:d3:2b:51:b0:8c:9b:b6:21:3c:2c

Digest Algorithm

sha256

PE Digest Matches

true

f5:1a:af:9d:7d:57:cc:7a:9f:2b:50:65:f5:e9:09:d8:1d:ed:97:c4
Signer

Actual PE Digest

f5:1a:af:9d:7d:57:cc:7a:9f:2b:50:65:f5:e9:09:d8:1d:ed:97:c4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

nssutil3

NSS_SecureMemcmpZero
SECITEM_FreeItem_Util
SECITEM_CompareItem_Util
SECOID_FindOIDTag_Util
PORT_ArenaAlloc_Util
SECITEM_ZfreeItem_Util
SECITEM_CopyItem_Util
SECITEM_AllocItem_Util
PORT_ArenaZAlloc_Util
PORT_NewArena_Util
PORT_ZAllocAlignedOffset_Util
PORT_FreeArena_Util
NSS_SecureMemcmp
PORT_GetError_Util
PORT_ZFree_Util
PORT_ZAlloc_Util
PORT_SetError_Util
PORT_Free_Util
PORT_Alloc_Util

libnspr4

PR_Free
PR_Seek
PR_Read
PR_Close
PR_Open
PR_GetLibraryFilePathname
PR_NotifyAllCondVar
PR_NotifyCondVar
PR_WaitCondVar
PR_DestroyCondVar
PR_NewCondVar
PR_GetEnvSecure
PR_Unlock
PR_Lock
PR_DestroyLock
PR_NewLock
PR_CallOnce

advapi32

SystemFunction036

kernel32

CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
HeapSize
HeapReAlloc
RtlUnwind
LCMapStringW
CreateFileW
GetStringTypeW
LoadLibraryW
OutputDebugStringW
LoadLibraryExW
LeaveCriticalSection
EnterCriticalSection
Sleep
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
SetUnhandledExceptionFilter
EncodePointer
GetDiskFreeSpaceA
GetLogicalDrives
QueryPerformanceCounter
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
GlobalMemoryStatus
GetVolumeInformationA
GetComputerNameA
GetSystemTimeAsFileTime
GetLastError
HeapFree
HeapAlloc
IsProcessorFeaturePresent
GetCommandLineA
IsDebuggerPresent
SetLastError
InterlockedIncrement
InterlockedDecrement
GetProcessHeap
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
UnhandledExceptionFilter

Exports

Exports

FREEBL_GetVector

Sections

.text
Size: 326KB - Virtual size: 325KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nss/libnspr4.dll
.dll windows:6 windows x86 arch:x86

1cb6e5250b52e41e0a21ead590e3996f

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:3a:37:a5:1c:46:82:3b:9b:27:ad:e5:db:bf:33:f1
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

18/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

Issuer

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Not Before

15/08/2017, 07:55

Not After

15/08/2028, 07:55

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/04/2015, 00:58

Not After

08/04/2025, 00:58

Subject

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7c:c7:56:da:99:7b:ce:03:37:5e:90:13:62:2d:fc:82:58:8f:8b:d9:8b:2e:4f:14:8e:1c:12:4c:4a:9e:68:89
Signer

Actual PE Digest

7c:c7:56:da:99:7b:ce:03:37:5e:90:13:62:2d:fc:82:58:8f:8b:d9:8b:2e:4f:14:8e:1c:12:4c:4a:9e:68:89

Digest Algorithm

sha256

PE Digest Matches

true

7c:c7:56:da:99:7b:ce:03:37:5e:90:13:62:2d:fc:82:58:8f:8b:d9:8b:2e:4f:14:8e:1c:12:4c:4a:9e:68:89
Signer

Actual PE Digest

7c:c7:56:da:99:7b:ce:03:37:5e:90:13:62:2d:fc:82:58:8f:8b:d9:8b:2e:4f:14:8e:1c:12:4c:4a:9e:68:89

Digest Algorithm

sha256

PE Digest Matches

true

7b:54:5e:83:54:a2:5e:b3:8f:d9:4d:5f:23:cf:c4:30:41:54:c5:79
Signer

Actual PE Digest

7b:54:5e:83:54:a2:5e:b3:8f:d9:4d:5f:23:cf:c4:30:41:54:c5:79

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

OpenProcessToken
AddAccessAllowedAce
AllocateAndInitializeSid
CopySid
FreeSid
GetLengthSid
GetTokenInformation
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner

ws2_32

WSACleanup
WSASetLastError
WSAStartup
shutdown
setsockopt
sendto
send
select
recvfrom
recv
getpeername
ioctlsocket
gethostname
socket
listen
getsockopt
getsockname
connect
bind
accept
getprotobyname
getprotobynumber
gethostbyname
gethostbyaddr
ntohs
ntohl
htons
htonl
WSAGetLastError
closesocket
__WSAFDIsSet

mswsock

GetAcceptExSockaddrs
AcceptEx
TransmitFile

winmm

timeGetTime

kernel32

SetEndOfFile
ReadConsoleW
CreateFileW
GetCurrentDirectoryW
GetFullPathNameW
PeekNamedPipe
SetEnvironmentVariableA
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetStringTypeW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapSize
LoadLibraryW
OutputDebugStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCurrentProcessId
GetModuleFileNameA
GetFileAttributesExW
FileTimeToSystemTime
GetDriveTypeW
FindFirstFileExW
FileTimeToLocalFileTime
GetTimeZoneInformation
RtlUnwind
GetConsoleMode
GetConsoleCP
ReadFile
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InterlockedCompareExchange
DebugBreak
OutputDebugStringA
TlsGetValue
TlsSetValue
WideCharToMultiByte
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LoadLibraryExW
MultiByteToWideChar
GetSystemInfo
InterlockedExchange
GlobalMemoryStatusEx
CloseHandle
CreatePipe
GetStdHandle
TryEnterCriticalSection
GetEnvironmentStrings
FreeEnvironmentStringsA
FlushFileBuffers
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
CreateProcessA
GetSystemTime
GetVersionExA
MapViewOfFile
FlushViewOfFile
UnmapViewOfFile
FormatMessageA
CreateFileMappingA
SystemTimeToFileTime
GetCurrentProcess
ReleaseSemaphore
CreateSemaphoreA
GetThreadContext
CreateDirectoryA
CreateFileA
DeleteFileA
FindClose
FindFirstFileA
FindNextFileA
GetDriveTypeA
GetFileAttributesExA
GetFileInformationByHandle
LockFileEx
RemoveDirectoryA
SetFilePointer
UnlockFileEx
WriteFile
GetHandleInformation
SetHandleInformation
SetErrorMode
GetOverlappedResult
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CancelIo
ResetEvent
Sleep
DeleteFiber
WaitForMultipleObjects
lstrlenA
GetLogicalDriveStringsA
MoveFileA
GetVolumeInformationA
IsDebuggerPresent
DuplicateHandle
RaiseException
SetLastError
CreateEventA
GetCurrentThread
SetThreadPriority
SuspendThread
ResumeThread
TlsAlloc
TlsFree
GetProcessAffinityMask
CreateFiber
ConvertThreadToFiber
SwitchToFiber
SetThreadAffinityMask
OpenSemaphoreA
QueryPerformanceCounter
GetTickCount
OpenFileMappingA
EncodePointer
DecodePointer
InterlockedDecrement
ExitProcess
GetModuleHandleExW
AreFileApisANSI
IsProcessorFeaturePresent
HeapFree
HeapAlloc
HeapReAlloc
CreateThread
GetCurrentThreadId
ExitThread
GetSystemTimeAsFileTime
GetCommandLineA
InitializeCriticalSectionAndSpinCount
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedIncrement
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetFileType
GetProcessHeap
SetEnvironmentVariableW

Exports

Exports

GetExecutionEnvironment
LL_MaxInt
LL_MaxUint
LL_MinInt
LL_Zero
PRP_DestroyNakedCondVar
PRP_NakedBroadcast
PRP_NakedNotify
PRP_NakedWait
PRP_NewNakedCondVar
PRP_TryLock
PR_Abort
PR_Accept
PR_AcceptRead
PR_Access
PR_AddToCounter
PR_AddWaitFileDesc
PR_AllocFileDesc
PR_Assert
PR_AssertCurrentThreadInMonitor
PR_AssertCurrentThreadOwnsLock
PR_AtomicAdd
PR_AtomicDecrement
PR_AtomicIncrement
PR_AtomicSet
PR_AttachSharedMemory
PR_AttachThread
PR_AttachThreadGCAble
PR_Available
PR_Available64
PR_Bind
PR_BlockClockInterrupts
PR_BlockInterrupt
PR_CEnterMonitor
PR_CExitMonitor
PR_CNotify
PR_CNotifyAll
PR_CSetOnMonitorRecycle
PR_CWait
PR_CallOnce
PR_CallOnceWithArg
PR_Calloc
PR_CancelJob
PR_CancelWaitFileDesc
PR_CancelWaitGroup
PR_CeilingLog2
PR_ChangeFileDescNativeHandle
PR_Cleanup
PR_ClearInterrupt
PR_ClearThreadGCAble
PR_Close
PR_CloseDir
PR_CloseFileMap
PR_CloseSemaphore
PR_CloseSharedMemory
PR_Connect
PR_ConnectContinue
PR_ConvertIPv4AddrToIPv6
PR_CreateAlarm
PR_CreateCounter
PR_CreateFileMap
PR_CreateIOLayer
PR_CreateIOLayerStub
PR_CreateMWaitEnumerator
PR_CreateOrderedLock
PR_CreatePipe
PR_CreateProcess
PR_CreateProcessDetached
PR_CreateSocketPollFd
PR_CreateStack
PR_CreateThread
PR_CreateThreadGCAble
PR_CreateThreadPool
PR_CreateTrace
PR_CreateWaitGroup
PR_DecrementCounter
PR_Delete
PR_DeleteSemaphore
PR_DeleteSharedMemory
PR_DestroyAlarm
PR_DestroyCondVar
PR_DestroyCounter
PR_DestroyLock
PR_DestroyMWaitEnumerator
PR_DestroyMonitor
PR_DestroyOrderedLock
PR_DestroyPollableEvent
PR_DestroyProcessAttr
PR_DestroyRWLock
PR_DestroySem
PR_DestroySocketPollFd
PR_DestroyStack
PR_DestroyTrace
PR_DestroyWaitGroup
PR_DetachProcess
PR_DetachSharedMemory
PR_DetachThread
PR_DisableClockInterrupts
PR_DuplicateEnvironment
PR_EXPERIMENTAL_ONLY_IN_4_17_GetOverlappedIOHandle
PR_EmulateAcceptRead
PR_EmulateSendFile
PR_EnableClockInterrupts
PR_EnterMonitor
PR_EnumerateAddrInfo
PR_EnumerateHostEnt
PR_EnumerateThreads
PR_EnumerateWaitGroup
PR_ErrorInstallCallback
PR_ErrorInstallTable
PR_ErrorLanguages
PR_ErrorToName
PR_ErrorToString
PR_ExitMonitor
PR_ExplodeTime
PR_ExportFileMapAsString
PR_FD_CLR
PR_FD_ISSET
PR_FD_NCLR
PR_FD_NISSET
PR_FD_NSET
PR_FD_SET
PR_FD_ZERO
PR_FileDesc2NativeHandle
PR_FindFunctionSymbol
PR_FindFunctionSymbolAndLibrary
PR_FindNextCounterQname
PR_FindNextCounterRname
PR_FindNextTraceQname
PR_FindNextTraceRname
PR_FindSymbol
PR_FindSymbolAndLibrary
PR_FloorLog2
PR_FormatTime
PR_FormatTimeUSEnglish
PR_Free
PR_FreeAddrInfo
PR_FreeFileDesc
PR_FreeLibraryName
PR_GMTParameters
PR_GetAddrInfoByName
PR_GetCanonNameFromAddrInfo
PR_GetConnectStatus
PR_GetCounter
PR_GetCounterHandleFromName
PR_GetCounterNameFromHandle
PR_GetCurrentThread
PR_GetDefaultIOMethods
PR_GetDescType
PR_GetDirectorySeparator
PR_GetDirectorySepartor
PR_GetEnv
PR_GetEnvSecure
PR_GetError
PR_GetErrorText
PR_GetErrorTextLength
PR_GetFileInfo
PR_GetFileInfo64
PR_GetFileMethods
PR_GetGCRegisters
PR_GetHostByAddr
PR_GetHostByName
PR_GetIPNodeByName
PR_GetIdentitiesLayer
PR_GetInheritedFD
PR_GetInheritedFileMap
PR_GetLayersIdentity
PR_GetLibraryFilePathname
PR_GetLibraryName
PR_GetLibraryPath
PR_GetMemMapAlignment
PR_GetMonitorEntryCount
PR_GetNameForIdentity
PR_GetNumberOfProcessors
PR_GetOSError
PR_GetOpenFileInfo
PR_GetOpenFileInfo64
PR_GetPageShift
PR_GetPageSize
PR_GetPathSeparator
PR_GetPeerName
PR_GetPhysicalMemorySize
PR_GetPipeMethods
PR_GetProtoByName
PR_GetProtoByNumber
PR_GetRandomNoise
PR_GetSP
PR_GetSockName
PR_GetSocketOption
PR_GetSpecialFD
PR_GetStackSpaceLeft
PR_GetSysfdTableMax
PR_GetSystemInfo
PR_GetTCPMethods
PR_GetThreadAffinityMask
PR_GetThreadID
PR_GetThreadName
PR_GetThreadPriority
PR_GetThreadPrivate
PR_GetThreadScope
PR_GetThreadState
PR_GetThreadType
PR_GetTraceEntries
PR_GetTraceHandleFromName
PR_GetTraceNameFromHandle
PR_GetTraceOption
PR_GetUDPMethods
PR_GetUniqueIdentity
PR_GetVersion
PR_ImplodeTime
PR_ImportFile
PR_ImportFileMapFromString
PR_ImportPipe
PR_ImportTCPSocket
PR_ImportUDPSocket
PR_IncrementCounter
PR_Init
PR_Initialize
PR_InitializeNetAddr
PR_Initialized
PR_Interrupt
PR_IntervalNow
PR_IntervalToMicroseconds
PR_IntervalToMilliseconds
PR_IntervalToSeconds
PR_IsNetAddrType
PR_JoinJob
PR_JoinThread
PR_JoinThreadPool
PR_KillProcess
PR_Listen
PR_LoadLibrary
PR_LoadLibraryWithFlags
PR_LoadStaticLibrary
PR_LocalTimeParameters
PR_Lock
PR_LockFile
PR_LockOrderedLock
PR_LogFlush
PR_LogPrint
PR_MakeDir
PR_Malloc
PR_MemMap
PR_MemUnmap
PR_MicrosecondsToInterval
PR_MillisecondsToInterval
PR_MkDir
PR_NTFast_Accept
PR_NTFast_AcceptRead
PR_NTFast_AcceptRead_WithTimeoutCallback
PR_NTFast_UpdateAcceptContext
PR_NT_CancelIo
PR_NetAddrToString
PR_NewCondVar
PR_NewLock
PR_NewLogModule
PR_NewMonitor
PR_NewNamedMonitor
PR_NewPollableEvent
PR_NewProcessAttr
PR_NewRWLock
PR_NewSem
PR_NewTCPSocket
PR_NewTCPSocketPair
PR_NewThreadPrivateIndex
PR_NewUDPSocket
PR_NormalizeTime
PR_Notify
PR_NotifyAll
PR_NotifyAllCondVar
PR_NotifyCondVar
PR_Now
PR_Open
PR_OpenAnonFileMap
PR_OpenDir
PR_OpenFile
PR_OpenSemaphore
PR_OpenSharedMemory
PR_OpenTCPSocket
PR_OpenUDPSocket
PR_ParseTimeString
PR_ParseTimeStringToExplodedTime
PR_Poll
PR_PopIOLayer
PR_PostSem
PR_PostSemaphore
PR_ProcessAttrSetCurrentDirectory
PR_ProcessAttrSetInheritableFD
PR_ProcessAttrSetInheritableFileMap
PR_ProcessAttrSetStdioRedirect
PR_ProcessExit
PR_PushIOLayer
PR_QueueJob
PR_QueueJob_Accept
PR_QueueJob_Connect
PR_QueueJob_Read
PR_QueueJob_Timer
PR_QueueJob_Write
PR_RWLock_Rlock
PR_RWLock_Unlock
PR_RWLock_Wlock
PR_Read
PR_ReadDir
PR_Realloc
PR_RecordTraceEntries
PR_Recv
PR_RecvFrom
PR_Rename
PR_ResetAlarm
PR_ResetProcessAttr
PR_ResumeAll
PR_RmDir
PR_ScanStackPointers
PR_SecondsToInterval
PR_Seek
PR_Seek64
PR_Select
PR_Send
PR_SendFile
PR_SendTo
PR_SetAlarm
PR_SetCPUAffinityMask
PR_SetConcurrency
PR_SetCounter
PR_SetCurrentThreadName
PR_SetEnv
PR_SetError
PR_SetErrorText
PR_SetFDCacheSize
PR_SetFDInheritable
PR_SetLibraryPath
PR_SetLogBuffering
PR_SetLogFile
PR_SetNetAddr
PR_SetPollableEvent
PR_SetSocketOption
PR_SetStdioRedirect
PR_SetSysfdTableSize
PR_SetThreadAffinityMask
PR_SetThreadDumpProc
PR_SetThreadGCAble
PR_SetThreadPriority
PR_SetThreadPrivate
PR_SetThreadRecycleMode
PR_SetTraceOption
PR_ShowStatus
PR_Shutdown
PR_ShutdownThreadPool
PR_Sleep
PR_Socket
PR_StackPop
PR_StackPush
PR_Stat
PR_StringToNetAddr
PR_SubtractFromCounter
PR_SuspendAll
PR_Sync
PR_SyncMemMap
PR_TLockFile
PR_TestAndEnterMonitor
PR_TestAndLock
PR_ThreadScanStackPointers
PR_TicksPerSecond
PR_Trace
PR_TransmitFile
PR_USPacificTimeParameters
PR_UnblockClockInterrupts
PR_UnblockInterrupt
PR_UnloadLibrary
PR_Unlock
PR_UnlockFile
PR_UnlockOrderedLock
PR_VersionCheck
PR_Wait
PR_WaitCondVar
PR_WaitForPollableEvent
PR_WaitProcess
PR_WaitRecvReady
PR_WaitSem
PR_WaitSemaphore
PR_Write
PR_Writev
PR_Yield
PR_cnvtf
PR_dtoa
PR_fprintf
PR_htonl
PR_htonll
PR_htons
PR_ntohl
PR_ntohll
PR_ntohs
PR_smprintf
PR_smprintf_free
PR_snprintf
PR_sprintf_append
PR_sscanf
PR_strtod
PR_sxprintf
PR_vfprintf
PR_vsmprintf
PR_vsnprintf
PR_vsprintf_append
PR_vsxprintf
PT_FPrintStats
SetExecutionEnvironment
_PR_AddSleepQ
_PR_CreateThread
_PR_DelSleepQ
_PR_GetPrimordialCPU
_PR_NativeCreateThread
_pr_push_ipv6toipv4_layer
_pr_test_ipv6_socket
libVersionPoint

Sections

.text
Size: 232KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 25B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nss/libplc4.dll
.dll windows:6 windows x86 arch:x86

4ee409b2691f16c4e2a7e5df451bdf4c

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:3a:37:a5:1c:46:82:3b:9b:27:ad:e5:db:bf:33:f1
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

18/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

Issuer

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Not Before

15/08/2017, 07:55

Not After

15/08/2028, 07:55

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/04/2015, 00:58

Not After

08/04/2025, 00:58

Subject

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

a0:f0:aa:f7:67:e7:1c:68:22:9c:1d:6a:fc:4c:36:ce:c6:40:13:6d:fa:9f:83:ba:85:19:44:c0:2e:d6:2e:17
Signer

Actual PE Digest

a0:f0:aa:f7:67:e7:1c:68:22:9c:1d:6a:fc:4c:36:ce:c6:40:13:6d:fa:9f:83:ba:85:19:44:c0:2e:d6:2e:17

Digest Algorithm

sha256

PE Digest Matches

true

a0:f0:aa:f7:67:e7:1c:68:22:9c:1d:6a:fc:4c:36:ce:c6:40:13:6d:fa:9f:83:ba:85:19:44:c0:2e:d6:2e:17
Signer

Actual PE Digest

a0:f0:aa:f7:67:e7:1c:68:22:9c:1d:6a:fc:4c:36:ce:c6:40:13:6d:fa:9f:83:ba:85:19:44:c0:2e:d6:2e:17

Digest Algorithm

sha256

PE Digest Matches

true

f7:7c:91:f8:3d:e7:39:f3:de:1c:f8:ab:ba:20:56:51:65:8e:bf:5e
Signer

Actual PE Digest

f7:7c:91:f8:3d:e7:39:f3:de:1c:f8:ab:ba:20:56:51:65:8e:bf:5e

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libnspr4

PR_SetError
PR_Calloc
PR_ErrorToName
PR_GetOSError
PR_GetError
PR_fprintf
PR_GetSpecialFD
PR_Free
PR_Malloc

kernel32

GetCurrentProcess
CreateFileW
CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetStringTypeW
GetLastError
HeapFree
HeapAlloc
GetCommandLineA
GetCurrentThreadId
GetProcessHeap
EncodePointer
DecodePointer
InterlockedDecrement
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetStdHandle
WriteFile
GetModuleFileNameW
IsProcessorFeaturePresent
SetLastError
InterlockedIncrement
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
Sleep
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
OutputDebugStringW
LoadLibraryW
RtlUnwind
HeapReAlloc
HeapSize
LCMapStringW

Exports

Exports

PL_Base64Decode
PL_Base64Encode
PL_CreateLongOptState
PL_CreateOptState
PL_DestroyOptState
PL_FPrintError
PL_GetNextOpt
PL_PrintError
PL_strcasecmp
PL_strcaserstr
PL_strcasestr
PL_strcat
PL_strcatn
PL_strchr
PL_strcmp
PL_strcpy
PL_strdup
PL_strfree
PL_strlen
PL_strncasecmp
PL_strncaserstr
PL_strncasestr
PL_strncat
PL_strnchr
PL_strncmp
PL_strncpy
PL_strncpyz
PL_strndup
PL_strnlen
PL_strnpbrk
PL_strnprbrk
PL_strnrchr
PL_strnrstr
PL_strnstr
PL_strpbrk
PL_strprbrk
PL_strrchr
PL_strrstr
PL_strstr
PL_strtok_r
libVersionPoint

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nss/libplds4.dll
.dll windows:6 windows x86 arch:x86

60b3bb9ca0311817f45dc1d6355db16d

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:3a:37:a5:1c:46:82:3b:9b:27:ad:e5:db:bf:33:f1
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

18/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

Issuer

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Not Before

15/08/2017, 07:55

Not After

15/08/2028, 07:55

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/04/2015, 00:58

Not After

08/04/2025, 00:58

Subject

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

83:c7:b3:09:27:1b:71:b7:3e:fa:46:b6:34:75:b9:6b:d0:8a:30:e2:16:dc:ca:6b:01:76:a8:a2:16:bf:60:8d
Signer

Actual PE Digest

83:c7:b3:09:27:1b:71:b7:3e:fa:46:b6:34:75:b9:6b:d0:8a:30:e2:16:dc:ca:6b:01:76:a8:a2:16:bf:60:8d

Digest Algorithm

sha256

PE Digest Matches

true

83:c7:b3:09:27:1b:71:b7:3e:fa:46:b6:34:75:b9:6b:d0:8a:30:e2:16:dc:ca:6b:01:76:a8:a2:16:bf:60:8d
Signer

Actual PE Digest

83:c7:b3:09:27:1b:71:b7:3e:fa:46:b6:34:75:b9:6b:d0:8a:30:e2:16:dc:ca:6b:01:76:a8:a2:16:bf:60:8d

Digest Algorithm

sha256

PE Digest Matches

true

60:6e:25:df:77:cc:69:47:95:0a:af:e3:5e:29:8b:9f:87:1d:6e:b1
Signer

Actual PE Digest

60:6e:25:df:77:cc:69:47:95:0a:af:e3:5e:29:8b:9f:87:1d:6e:b1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libnspr4

PR_CeilingLog2
PR_Free
PR_Malloc

kernel32

GetModuleHandleW
CreateFileW
CloseHandle
WriteConsoleW
GetCommandLineA
GetCurrentThreadId
IsProcessorFeaturePresent
GetLastError
SetLastError
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetProcessHeap
GetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
Sleep
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
IsDebuggerPresent
WriteFile
GetModuleFileNameW
LoadLibraryExW
RtlUnwind
HeapAlloc
HeapReAlloc
GetStringTypeW
OutputDebugStringW
LoadLibraryW
HeapSize
LCMapStringW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx

Exports

Exports

PL_ArenaAllocate
PL_ArenaFinish
PL_ArenaGrow
PL_ArenaRelease
PL_ClearArenaPool
PL_CompactArenaPool
PL_CompareStrings
PL_CompareValues
PL_FinishArenaPool
PL_FreeArenaPool
PL_HashString
PL_HashTableAdd
PL_HashTableDestroy
PL_HashTableDump
PL_HashTableEnumerateEntries
PL_HashTableLookup
PL_HashTableLookupConst
PL_HashTableRawAdd
PL_HashTableRawLookup
PL_HashTableRawLookupConst
PL_HashTableRawRemove
PL_HashTableRemove
PL_InitArenaPool
PL_NewHashTable
PL_SizeOfArenaPoolExcludingPool
libVersionPoint

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nss/mozcrt19.dll
.dll windows:4 windows x86 arch:x86

7cea1bcca1ff18e164507fda5b70c620

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:cc:37:35:e9:ec:1f:c9:71:67:0e:73:e3:69:c7:91
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

30/10/2009, 00:00

Not After

30/10/2010, 23:59

Subject

CN=Mozilla Corporation,OU=Release Engineering,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d2:db:44:bf:49:80:f2:89:0e:c9:f5:dc:34:b7:e3:e5:40:2f:0e:fe:2c:4d:9b:eb:d0:d7:fa:c6:55:64:01:cc
Signer

Actual PE Digest

d2:db:44:bf:49:80:f2:89:0e:c9:f5:dc:34:b7:e3:e5:40:2f:0e:fe:2c:4d:9b:eb:d0:d7:fa:c6:55:64:01:cc

Digest Algorithm

sha256

PE Digest Matches

true

d9:6d:c7:8e:a6:fa:0a:7b:10:3b:1a:05:51:cf:8f:d6:d7:18:c7:39
Signer

Actual PE Digest

d9:6d:c7:8e:a6:fa:0a:7b:10:3b:1a:05:51:cf:8f:d6:d7:18:c7:39

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\builds\moz2_slave\win32_build\build\obj-firefox\memory\jemalloc\crtsrc\build\intel\MOZCRT19.pdb

Imports

msvcrt

_getdrives

kernel32

GetCurrentProcessId
GetLocalTime
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetCurrentThreadId
TlsGetValue
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
ExitThread
CloseHandle
GetLastError
ResumeThread
CreateThread
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
GetCurrentThread
FindNextFileA
FindFirstFileA
FindClose
FindNextFileW
FindFirstFileW
Sleep
GetEnvironmentVariableA
VirtualFree
VirtualAlloc
GetSystemInfo
SetHandleCount
GetFileType
GetStartupInfoA
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
SetFilePointer
SetStdHandle
CreateFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryA
InitializeCriticalSection
MultiByteToWideChar
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
QueryPerformanceCounter
GetTickCount
SetLocalTime
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
GetLocaleInfoW
SetEnvironmentVariableA
SetEnvironmentVariableW
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
RtlUnwind
GetTimeFormatA
GetDateFormatA
GetTimeZoneInformation
FlushFileBuffers
CompareStringA
CompareStringW
Beep
FileTimeToSystemTime
FileTimeToLocalFileTime
GetDiskFreeSpaceA
GetLogicalDrives
SetErrorMode
GetFileAttributesA
GetCurrentDirectoryA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetDriveTypeA
CreateDirectoryA
RemoveDirectoryA
DeleteFileA
GetFileAttributesW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetFileAttributesW
GetFullPathNameW
CreateDirectoryW
DeleteFileW
MoveFileW
RemoveDirectoryW
GetDriveTypeW
MoveFileA
RaiseException
GetExitCodeProcess
WaitForSingleObject
CreateProcessA
CreateProcessW
VirtualProtect
VirtualQuery
IsDBCSLeadByteEx
ReadConsoleA
ReadConsoleW
SetConsoleMode
SetEndOfFile
DuplicateHandle
GetFileInformationByHandle
PeekNamedPipe
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
ReadConsoleInputW
LockFile
UnlockFile
CreatePipe
ReadFile
CreateFileW
LoadLibraryW
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime

Exports

Exports

$I10_OUTPUT
??0__non_rtti_object@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
??0bad_typeid@std@@QAE@ABV01@@Z
??0bad_typeid@std@@QAE@PBD@Z
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABQBDH@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@XZ
??1__non_rtti_object@std@@UAE@XZ
??1bad_cast@std@@UAE@XZ
??1bad_typeid@std@@UAE@XZ
??1exception@std@@UAE@XZ
??1type_info@@UAE@XZ
??2@YAPAXI@Z
??2@YAPAXIHPBDH@Z
??3@YAXPAX@Z
??4__non_rtti_object@std@@QAEAAV01@ABV01@@Z
??4bad_cast@std@@QAEAAV01@ABV01@@Z
??4bad_typeid@std@@QAEAAV01@ABV01@@Z
??4exception@std@@QAEAAV01@ABV01@@Z
??8type_info@@QBE_NABV0@@Z
??9type_info@@QBE_NABV0@@Z
??_7__non_rtti_object@std@@6B@
??_7bad_cast@std@@6B@
??_7bad_typeid@std@@6B@
??_7exception@@6B@
??_7exception@std@@6B@
??_Fbad_cast@std@@QAEXXZ
??_Fbad_typeid@std@@QAEXXZ
??_U@YAPAXI@Z
??_U@YAPAXIHPBDH@Z
??_V@YAXPAX@Z
?_Name_base@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Name_base_internal@type_info@@CAPBDPBV1@PAU__type_info_node@@@Z
?_Type_info_dtor@type_info@@CAXPAV1@@Z
?_Type_info_dtor_internal@type_info@@CAXPAV1@@Z
?_ValidateExecute@@YAHP6GHXZ@Z
?_ValidateRead@@YAHPBXI@Z
?_ValidateWrite@@YAHPAXI@Z
?_inconsistency@@YAXXZ
?_invalid_parameter@@YAXPBG00II@Z
?_is_exception_typeof@@YAHABVtype_info@@PAU_EXCEPTION_POINTERS@@@Z
?_name_internal_method@type_info@@QBEPBDPAU__type_info_node@@@Z
?_open@@YAHPBDHH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZH@Z
?_set_se_translator@@YAP6AXIPAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
?_sopen@@YAHPBDHHH@Z
?_type_info_dtor_internal_method@type_info@@QAEXXZ
?_wopen@@YAHPB_WHH@Z
?_wsopen@@YAHPB_WHHH@Z
?before@type_info@@QBEHABV1@@Z
?name@type_info@@QBEPBDPAU__type_info_node@@@Z
?raw_name@type_info@@QBEPBDXZ
?set_terminate@@YAP6AXXZH@Z
?set_terminate@@YAP6AXXZP6AXXZ@Z
?set_unexpected@@YAP6AXXZH@Z
?set_unexpected@@YAP6AXXZP6AXXZ@Z
?swprintf@@YAHPAGIPBGZZ
?swprintf@@YAHPA_WIPB_WZZ
?terminate@@YAXXZ
?unexpected@@YAXXZ
?vswprintf@@YAHPA_WIPB_WPAD@Z
?what@exception@std@@UBEPBDXZ
@_calloc_crt@8
@_malloc_crt@4
@_realloc_crt@8
_CIacos
_CIasin
_CIatan
_CIatan2
_CIcos
_CIcosh
_CIexp
_CIfmod
_CIlog
_CIlog10
_CIpow
_CIsin
_CIsinh
_CIsqrt
_CItan
_CItanh
_CRT_RTC_INIT
_CRT_RTC_INITW
_CreateFrameInfo
_CxxThrowException
_EH_prolog
_FindAndUnlinkFrame
_Getdays
_Getmonths
_Gettnames
_HUGE
_IsExceptionObjectToBeDestroyed
_NLG_Dispatch2
_NLG_Return
_NLG_Return2
_Strftime
_XcptFilter
__AdjustPointer
__BuildCatchObject
__BuildCatchObjectHelper
__CppXcptFilter
__CxxCallUnwindDelDtor
__CxxCallUnwindDtor
__CxxCallUnwindStdDelDtor
__CxxCallUnwindVecDtor
__CxxDetectRethrow
__CxxExceptionFilter
__CxxFrameHandler
__CxxFrameHandler2
__CxxFrameHandler3
__CxxLongjmpUnwind
__CxxQueryExceptionSize
__CxxRegisterExceptionObject
__CxxUnregisterExceptionObject
__DestructExceptionObject
__FrameUnwindFilter
__RTCastToVoid
__RTDynamicCast
__RTtypeid
__STRINGTOLD
__STRINGTOLD_L
__TypeMatch
___fls_getvalue@4
___fls_setvalue@8
___lc_codepage_func
___lc_collate_cp_func
___lc_handle_func
___mb_cur_max_func
___mb_cur_max_l_func
___setlc_active_func
___unguarded_readlc_active_add_func
__argc
__argv
__badioinfo
__clean_type_info_names_internal
__control87_2
__create_locale
__crtCompareStringA
__crtCompareStringW
__crtGetLocaleInfoW
__crtGetStringTypeW
__crtLCMapStringA
__crtLCMapStringW
__daylight
__dllonexit
__doserrno
__dstbias
__fpecode
__free_locale
__get_app_type
__get_current_locale
__get_flsindex
__get_tlsindex
__getmainargs
__initenv
__iob_func
__isascii
__iscsym
__iscsymf
__iswcsym
__iswcsymf
__lc_clike
__lc_codepage
__lc_collate_cp
__lc_handle
__lconv
__lconv_init
__libm_sse2_acos
__libm_sse2_acosf
__libm_sse2_asin
__libm_sse2_asinf
__libm_sse2_atan
__libm_sse2_atan2
__libm_sse2_atanf
__libm_sse2_cos
__libm_sse2_cosf
__libm_sse2_exp
__libm_sse2_expf
__libm_sse2_log
__libm_sse2_log10
__libm_sse2_log10f
__libm_sse2_logf
__libm_sse2_pow
__libm_sse2_powf
__libm_sse2_sin
__libm_sse2_sinf
__libm_sse2_tan
__libm_sse2_tanf
__mb_cur_max
__p___argc
__p___argv
__p___initenv
__p___mb_cur_max
__p___wargv
__p___winitenv
__p__acmdln
__p__commode
__p__daylight
__p__dstbias
__p__environ
__p__fmode
__p__iob
__p__mbcasemap
__p__mbctype
__p__osplatform
__p__osver
__p__pctype
__p__pgmptr
__p__pwctype
__p__timezone
__p__tzname
__p__wcmdln
__p__wenviron
__p__winmajor
__p__winminor
__p__winver
__p__wpgmptr
__pctype_func
__pioinfo
__pwctype_func
__pxcptinfoptrs
__report_gsfailure
__set_app_type
__set_flsgetvalue
__setlc_active
__setusermatherr
__strncnt
__swprintf_l
__sys_errlist
__sys_nerr
__threadhandle
__threadid
__timezone
__toascii
__tzname
__unDName
__unDNameEx
__unDNameHelper
__uncaught_exception
__unguarded_readlc_active
__vswprintf_l
__wargv
__wcserror
__wcserror_s
__wcsncnt
__wgetmainargs
__winitenv
_abnormal_termination
_abs64
_access
_access_s
_acmdln
_adj_fdiv_m16i
_adj_fdiv_m32
_adj_fdiv_m32i
_adj_fdiv_m64
_adj_fdiv_r
_adj_fdivr_m16i
_adj_fdivr_m32
_adj_fdivr_m32i
_adj_fdivr_m64
_adj_fpatan
_adj_fprem
_adj_fprem1
_adj_fptan
_adjust_fdiv
_aexit_rtn
_aligned_free
_aligned_malloc
_aligned_msize
_aligned_offset_malloc
_aligned_offset_realloc
_aligned_offset_recalloc
_aligned_realloc
_aligned_recalloc
_amsg_exit
_assert
_atodbl
_atodbl_l
_atof_l
_atoflt
_atoflt_l
_atoi64
_atoi64_l
_atoi_l
_atol_l
_atoldbl
_atoldbl_l
_beep
_beginthread
_beginthreadex
_byteswap_uint64
_byteswap_ulong
_byteswap_ushort
_c_exit
_cabs
_calloc_crt
_cexit
_cgets
_cgets_s
_cgetws
_cgetws_s
_chdir
_chdrive
_chgsign
_chkesp
_chmod
_chsize
_chsize_s
_clearfp
_close
_commit
_commode
_configthreadlocale
_control87
_controlfp
_controlfp_s
_copysign
_cprintf
_cprintf_l
_cprintf_p
_cprintf_p_l
_cprintf_s
_cprintf_s_l
_cputs
_cputws
_creat
_create_locale
_crt_debugger_hook
_cscanf
_cscanf_l
_cscanf_s
_cscanf_s_l
_ctime32
_ctime32_s
_ctime64
_ctime64_s
_cwait
_cwprintf
_cwprintf_l
_cwprintf_p
_cwprintf_p_l
_cwprintf_s
_cwprintf_s_l
_cwscanf
_cwscanf_l
_cwscanf_s
_cwscanf_s_l
_daylight
_decode_pointer
_difftime32
_difftime64
_dosmaperr
_dstbias
_dup
_dup2
_dupenv_s
_ecvt
_ecvt_s
_encode_pointer
_encoded_null
_endthread
_endthreadex
_environ
_eof
_errno
_except_handler2
_except_handler3
_except_handler4_common
_execl
_execle
_execlp
_execlpe
_execv
_execve
_execvp
_execvpe
_exit
_expand
_fclose_nolock
_fcloseall
_fcvt
_fcvt_s
_fdopen
_fflush_nolock
_fgetchar
_fgetwc_nolock
_fgetwchar
_filbuf
_filelength
_filelengthi64
_fileno
_findclose
_findfirst32
_findfirst32i64
_findfirst64
_findfirst64i32
_findnext32
_findnext32i64
_findnext64
_findnext64i32
_finite
_flsbuf
_flushall
_fmode
_fpclass
_fpieee_flt
_fpreset
_fprintf_l
_fprintf_p
_fprintf_p_l
_fprintf_s_l
_fputchar
_fputwc_nolock
_fputwchar
_fread_nolock
_fread_nolock_s
_free_locale
_freea
_freea_s
_freefls
_fscanf_l
_fscanf_s_l
_fseek_nolock
_fseeki64
_fseeki64_nolock
_fsopen
_fstat32
_fstat32i64
_fstat64
_fstat64i32
_ftell_nolock
_ftelli64
_ftelli64_nolock
_ftime32
_ftime32_s
_ftime64
_ftime64_s
_ftol
_fullpath
_futime32
_futime64
_fwprintf_l
_fwprintf_p
_fwprintf_p_l
_fwprintf_s_l
_fwrite_nolock
_fwscanf_l
_fwscanf_s_l
_gcvt
_gcvt_s
_get_current_locale
_get_daylight
_get_doserrno
_get_dstbias
_get_errno
_get_fmode
_get_invalid_parameter_handler
_get_osfhandle
_get_osplatform
_get_osver
_get_output_format
_get_pgmptr
_get_printf_count_output
_get_purecall_handler
_get_terminate
_get_timezone
_get_tzname
_get_unexpected
_get_winmajor
_get_winminor
_get_winver
_get_wpgmptr
_getch
_getch_nolock
_getche
_getche_nolock
_getcwd
_getdcwd
_getdcwd_nolock
_getdiskfree
_getdllprocaddr
_getdrive
_getdrives
_getmaxstdio
_getmbcp
_getpid
_getptd
_getsystime
_getw
_getwch
_getwch_nolock
_getwche
_getwche_nolock
_getws
_getws_s
_global_unwind2

Sections

.text
Size: 480KB - Virtual size: 478KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 176KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nss/nspr4.dll
.dll windows:4 windows x86 arch:x86

2f18ebeca6261a49374a46ce4247a667

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:cc:37:35:e9:ec:1f:c9:71:67:0e:73:e3:69:c7:91
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

30/10/2009, 00:00

Not After

30/10/2010, 23:59

Subject

CN=Mozilla Corporation,OU=Release Engineering,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d1:79:4a:b8:34:28:ac:13:b8:60:d5:31:c8:8e:49:ba:3a:f1:a7:83:0f:8d:65:3b:a7:54:f0:5a:b4:f7:25:47
Signer

Actual PE Digest

d1:79:4a:b8:34:28:ac:13:b8:60:d5:31:c8:8e:49:ba:3a:f1:a7:83:0f:8d:65:3b:a7:54:f0:5a:b4:f7:25:47

Digest Algorithm

sha256

PE Digest Matches

true

83:66:8e:34:d2:cb:0f:40:cd:0b:e1:e4:c6:0c:08:61:4c:d7:08:9b
Signer

Actual PE Digest

83:66:8e:34:d2:cb:0f:40:cd:0b:e1:e4:c6:0c:08:61:4c:d7:08:9b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\builds\moz2_slave\win32_build\build\obj-firefox\nsprpub\pr\src\nspr4.pdb

Imports

advapi32

AllocateAndInitializeSid
CopySid
GetLengthSid
GetTokenInformation
OpenProcessToken
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
InitializeSecurityDescriptor

wsock32

recvfrom
sendto
send
recv
connect
accept
select
__WSAFDIsSet
setsockopt
getpeername
getsockname
shutdown
listen
bind
inet_ntoa
closesocket
WSAStartup
WSACleanup
gethostname
getsockopt
WSAGetLastError
ioctlsocket
ntohl
ntohs
htons
getprotobynumber
getprotobyname
gethostbyaddr
gethostbyname
htonl
socket

winmm

timeGetTime

mozcrt19

_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_decode_pointer
_encoded_null
_malloc_crt
_encode_pointer
_time64
_stat64i32
_access
_mbspbrk
_mbsdec
_mbsinc
_beginthreadex
_exit
_environ
qsort
_stricmp
strpbrk
strftime
_mktime64
_localtime64
strncmp
_errno
strerror
realloc
calloc
malloc
strrchr
strstr
getenv
memset
strchr
isdigit
strtoul
strtol
isspace
tolower
memchr
sprintf
abort
free
fwrite
fflush
fopen
setvbuf
__iob_func
fclose
sscanf
memcpy
atoi
_strdup
isalpha
_putenv

kernel32

ResumeThread
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InterlockedCompareExchange
OpenFileMappingA
GetTickCount
QueryPerformanceCounter
OpenSemaphoreA
LoadLibraryW
LeaveCriticalSection
UnlockFile
LockFile
RemoveDirectoryA
CreateDirectoryA
MoveFileA
GetHandleInformation
SetHandleInformation
GetFileInformationByHandle
SetLastError
FindFirstFileA
GetFullPathNameA
GetDriveTypeA
DeleteFileA
FindNextFileA
FindClose
FlushFileBuffers
SetFilePointer
WriteFile
ReadFile
SuspendThread
SetThreadPriority
GetCurrentThread
DuplicateHandle
TlsFree
TlsAlloc
GetThreadContext
ReleaseSemaphore
CreateSemaphoreA
GetCurrentProcess
UnmapViewOfFile
MapViewOfFile
FormatMessageA
CreateFileMappingA
GetVersionExA
TerminateProcess
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
GetEnvironmentStrings
FreeEnvironmentStringsA
GetSystemTime
SystemTimeToFileTime
TlsSetValue
DeleteCriticalSection
InitializeCriticalSection
TlsGetValue
Sleep
GetStdHandle
CreatePipe
CreateFileA
CloseHandle
GlobalMemoryStatus
InterlockedExchange
GetSystemInfo
GetModuleHandleW
GetModuleFileNameW
GetProcAddress
FreeLibrary
MultiByteToWideChar
WideCharToMultiByte
GetLastError
LoadLibraryExW
GetModuleHandleA
DebugBreak
EnterCriticalSection
OutputDebugStringA

Exports

Exports

GetExecutionEnvironment
LL_MaxInt
LL_MaxUint
LL_MinInt
LL_Zero
PRP_DestroyNakedCondVar
PRP_NakedBroadcast
PRP_NakedNotify
PRP_NakedWait
PRP_NewNakedCondVar
PRP_TryLock
PR_Abort
PR_Accept
PR_AcceptRead
PR_Access
PR_AddToCounter
PR_AddWaitFileDesc
PR_AllocFileDesc
PR_Assert
PR_AssertCurrentThreadInMonitor
PR_AssertCurrentThreadOwnsLock
PR_AtomicAdd
PR_AtomicDecrement
PR_AtomicIncrement
PR_AtomicSet
PR_AttachSharedMemory
PR_AttachThread
PR_AttachThreadGCAble
PR_Available
PR_Available64
PR_Bind
PR_BlockClockInterrupts
PR_BlockInterrupt
PR_CEnterMonitor
PR_CExitMonitor
PR_CNotify
PR_CNotifyAll
PR_CSetOnMonitorRecycle
PR_CWait
PR_CallOnce
PR_CallOnceWithArg
PR_Calloc
PR_CancelJob
PR_CancelWaitFileDesc
PR_CancelWaitGroup
PR_CeilingLog2
PR_ChangeFileDescNativeHandle
PR_Cleanup
PR_ClearInterrupt
PR_ClearThreadGCAble
PR_Close
PR_CloseDir
PR_CloseFileMap
PR_CloseSemaphore
PR_CloseSharedMemory
PR_Connect
PR_ConnectContinue
PR_ConvertIPv4AddrToIPv6
PR_CreateAlarm
PR_CreateCounter
PR_CreateFileMap
PR_CreateIOLayer
PR_CreateIOLayerStub
PR_CreateMWaitEnumerator
PR_CreateOrderedLock
PR_CreatePipe
PR_CreateProcess
PR_CreateProcessDetached
PR_CreateSocketPollFd
PR_CreateStack
PR_CreateThread
PR_CreateThreadGCAble
PR_CreateThreadPool
PR_CreateTrace
PR_CreateWaitGroup
PR_DecrementCounter
PR_Delete
PR_DeleteSemaphore
PR_DeleteSharedMemory
PR_DestroyAlarm
PR_DestroyCondVar
PR_DestroyCounter
PR_DestroyLock
PR_DestroyMWaitEnumerator
PR_DestroyMonitor
PR_DestroyOrderedLock
PR_DestroyPollableEvent
PR_DestroyProcessAttr
PR_DestroyRWLock
PR_DestroySem
PR_DestroySocketPollFd
PR_DestroyStack
PR_DestroyTrace
PR_DestroyWaitGroup
PR_DetachProcess
PR_DetachSharedMemory
PR_DetachThread
PR_DisableClockInterrupts
PR_EmulateAcceptRead
PR_EmulateSendFile
PR_EnableClockInterrupts
PR_EnterMonitor
PR_EnumerateAddrInfo
PR_EnumerateHostEnt
PR_EnumerateThreads
PR_EnumerateWaitGroup
PR_ErrorInstallCallback
PR_ErrorInstallTable
PR_ErrorLanguages
PR_ErrorToName
PR_ErrorToString
PR_ExitMonitor
PR_ExplodeTime
PR_ExportFileMapAsString
PR_FD_CLR
PR_FD_ISSET
PR_FD_NCLR
PR_FD_NISSET
PR_FD_NSET
PR_FD_SET
PR_FD_ZERO
PR_FileDesc2NativeHandle
PR_FindFunctionSymbol
PR_FindFunctionSymbolAndLibrary
PR_FindNextCounterQname
PR_FindNextCounterRname
PR_FindNextTraceQname
PR_FindNextTraceRname
PR_FindSymbol
PR_FindSymbolAndLibrary
PR_FloorLog2
PR_FormatTime
PR_FormatTimeUSEnglish
PR_Free
PR_FreeAddrInfo
PR_FreeFileDesc
PR_FreeLibraryName
PR_GMTParameters
PR_GetAddrInfoByName
PR_GetCanonNameFromAddrInfo
PR_GetConnectStatus
PR_GetCounter
PR_GetCounterHandleFromName
PR_GetCounterNameFromHandle
PR_GetCurrentThread
PR_GetDefaultIOMethods
PR_GetDescType
PR_GetDirectorySeparator
PR_GetDirectorySepartor
PR_GetEnv
PR_GetError
PR_GetErrorText
PR_GetErrorTextLength
PR_GetFileInfo
PR_GetFileInfo64
PR_GetFileMethods
PR_GetGCRegisters
PR_GetHostByAddr
PR_GetHostByName
PR_GetIPNodeByName
PR_GetIdentitiesLayer
PR_GetInheritedFD
PR_GetInheritedFileMap
PR_GetLayersIdentity
PR_GetLibraryFilePathname
PR_GetLibraryName
PR_GetLibraryPath
PR_GetMemMapAlignment
PR_GetMonitorEntryCount
PR_GetNameForIdentity
PR_GetNumberOfProcessors
PR_GetOSError
PR_GetOpenFileInfo
PR_GetOpenFileInfo64
PR_GetPageShift
PR_GetPageSize
PR_GetPathSeparator
PR_GetPeerName
PR_GetPhysicalMemorySize
PR_GetPipeMethods
PR_GetProtoByName
PR_GetProtoByNumber
PR_GetRandomNoise
PR_GetSP
PR_GetSockName
PR_GetSocketOption
PR_GetSpecialFD
PR_GetStackSpaceLeft
PR_GetSysfdTableMax
PR_GetSystemInfo
PR_GetTCPMethods
PR_GetThreadAffinityMask
PR_GetThreadID
PR_GetThreadPriority
PR_GetThreadPrivate
PR_GetThreadScope
PR_GetThreadState
PR_GetThreadType
PR_GetTraceEntries
PR_GetTraceHandleFromName
PR_GetTraceNameFromHandle
PR_GetTraceOption
PR_GetUDPMethods
PR_GetUniqueIdentity
PR_ImplodeTime
PR_ImportFile
PR_ImportFileMapFromString
PR_ImportPipe
PR_ImportTCPSocket
PR_ImportUDPSocket
PR_IncrementCounter
PR_Init
PR_Initialize
PR_InitializeNetAddr
PR_Initialized
PR_Interrupt
PR_IntervalNow
PR_IntervalToMicroseconds
PR_IntervalToMilliseconds
PR_IntervalToSeconds
PR_IsNetAddrType
PR_JoinJob
PR_JoinThread
PR_JoinThreadPool
PR_KillProcess
PR_Listen
PR_LoadLibrary
PR_LoadLibraryWithFlags
PR_LoadStaticLibrary
PR_LocalTimeParameters
PR_Lock
PR_LockFile
PR_LockOrderedLock
PR_LogFlush
PR_LogPrint
PR_MakeDir
PR_Malloc
PR_MemMap
PR_MemUnmap
PR_MicrosecondsToInterval
PR_MillisecondsToInterval
PR_MkDir
PR_NetAddrToString
PR_NewCondVar
PR_NewLock
PR_NewLogModule
PR_NewMonitor
PR_NewNamedMonitor
PR_NewPollableEvent
PR_NewProcessAttr
PR_NewRWLock
PR_NewSem
PR_NewTCPSocket
PR_NewTCPSocketPair
PR_NewThreadPrivateIndex
PR_NewUDPSocket
PR_NormalizeTime
PR_Notify
PR_NotifyAll
PR_NotifyAllCondVar
PR_NotifyCondVar
PR_Now
PR_Open
PR_OpenAnonFileMap
PR_OpenDir
PR_OpenFile
PR_OpenSemaphore
PR_OpenSharedMemory
PR_OpenTCPSocket
PR_OpenUDPSocket
PR_ParseTimeString
PR_ParseTimeStringToExplodedTime
PR_Poll
PR_PopIOLayer
PR_PostSem
PR_PostSemaphore
PR_ProcessAttrSetCurrentDirectory
PR_ProcessAttrSetInheritableFD
PR_ProcessAttrSetInheritableFileMap
PR_ProcessAttrSetStdioRedirect
PR_ProcessExit
PR_PushIOLayer
PR_QueueJob
PR_QueueJob_Accept
PR_QueueJob_Connect
PR_QueueJob_Read
PR_QueueJob_Timer
PR_QueueJob_Write
PR_RWLock_Rlock
PR_RWLock_Unlock
PR_RWLock_Wlock
PR_Read
PR_ReadDir
PR_Realloc
PR_RecordTraceEntries
PR_Recv
PR_RecvFrom
PR_Rename
PR_ResetAlarm
PR_ResetProcessAttr
PR_ResumeAll
PR_RmDir
PR_ScanStackPointers
PR_SecondsToInterval
PR_Seek
PR_Seek64
PR_Select
PR_Send
PR_SendFile
PR_SendTo
PR_SetAlarm
PR_SetCPUAffinityMask
PR_SetConcurrency
PR_SetCounter
PR_SetEnv
PR_SetError
PR_SetErrorText
PR_SetFDCacheSize
PR_SetFDInheritable
PR_SetLibraryPath
PR_SetLogBuffering
PR_SetLogFile
PR_SetNetAddr
PR_SetPollableEvent
PR_SetSocketOption
PR_SetStdioRedirect
PR_SetSysfdTableSize
PR_SetThreadAffinityMask
PR_SetThreadDumpProc
PR_SetThreadGCAble
PR_SetThreadPriority
PR_SetThreadPrivate
PR_SetThreadRecycleMode
PR_SetTraceOption
PR_ShowStatus
PR_Shutdown
PR_ShutdownThreadPool
PR_Sleep
PR_Socket
PR_StackPop
PR_StackPush
PR_Stat
PR_StringToNetAddr
PR_SubtractFromCounter
PR_SuspendAll
PR_Sync
PR_TLockFile
PR_TestAndEnterMonitor
PR_TestAndLock
PR_ThreadScanStackPointers
PR_TicksPerSecond
PR_Trace
PR_TransmitFile
PR_USPacificTimeParameters
PR_UnblockClockInterrupts
PR_UnblockInterrupt
PR_UnloadLibrary
PR_Unlock
PR_UnlockFile
PR_UnlockOrderedLock
PR_VersionCheck
PR_Wait
PR_WaitCondVar
PR_WaitForPollableEvent
PR_WaitProcess
PR_WaitRecvReady
PR_WaitSem
PR_WaitSemaphore
PR_Write
PR_Writev
PR_Yield
PR_cnvtf
PR_dtoa
PR_fprintf
PR_htonl
PR_htonll
PR_htons
PR_ntohl
PR_ntohll
PR_ntohs
PR_smprintf
PR_smprintf_free
PR_snprintf
PR_sprintf_append
PR_sscanf
PR_strtod
PR_sxprintf
PR_vfprintf
PR_vsmprintf
PR_vsnprintf
PR_vsprintf_append
PR_vsxprintf
PT_FPrintStats
SetExecutionEnvironment
_PR_AddSleepQ
_PR_CreateThread
_PR_DelSleepQ
_PR_GetPrimordialCPU
_PR_MD_FREE_CV
_PR_MD_NEW_CV
_PR_MD_NOTIFYALL_CV
_PR_MD_NOTIFY_CV
_PR_MD_UNLOCK
_PR_MD_WAIT_CV
_PR_NativeCreateThread
_pr_push_ipv6toipv4_layer
_pr_test_ipv6_socket
libVersionPoint

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nss/nss3.dll
.dll windows:6 windows x86 arch:x86

266139839e33db03b75c32f1a5c88865

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:3a:37:a5:1c:46:82:3b:9b:27:ad:e5:db:bf:33:f1
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

18/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

Issuer

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Not Before

15/08/2017, 07:55

Not After

15/08/2028, 07:55

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/04/2015, 00:58

Not After

08/04/2025, 00:58

Subject

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

eb:a0:89:8d:f9:e9:4a:7b:bf:ea:47:68:a0:c1:0f:e7:43:dc:a2:7b:b4:d9:3e:ac:2b:54:a1:bf:bd:93:6e:ba
Signer

Actual PE Digest

eb:a0:89:8d:f9:e9:4a:7b:bf:ea:47:68:a0:c1:0f:e7:43:dc:a2:7b:b4:d9:3e:ac:2b:54:a1:bf:bd:93:6e:ba

Digest Algorithm

sha256

PE Digest Matches

true

eb:a0:89:8d:f9:e9:4a:7b:bf:ea:47:68:a0:c1:0f:e7:43:dc:a2:7b:b4:d9:3e:ac:2b:54:a1:bf:bd:93:6e:ba
Signer

Actual PE Digest

eb:a0:89:8d:f9:e9:4a:7b:bf:ea:47:68:a0:c1:0f:e7:43:dc:a2:7b:b4:d9:3e:ac:2b:54:a1:bf:bd:93:6e:ba

Digest Algorithm

sha256

PE Digest Matches

true

f2:2d:22:2e:85:39:8f:5d:d6:33:5b:e3:f8:51:8f:52:31:6a:41:ea
Signer

Actual PE Digest

f2:2d:22:2e:85:39:8f:5d:d6:33:5b:e3:f8:51:8f:52:31:6a:41:ea

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

nssutil3

PORT_RegExpCaseSearch
PORT_RegExpValid
SECITEM_HashCompare
NSS_Get_SEC_IA5StringTemplate_Util
NSS_Get_SEC_SkipTemplate
SEC_StringToOID
PK11URI_FormatURI
SECOID_KnownCertExtenOID
DER_GetUInteger
PORT_UCS4_UTF8Conversion
PORT_ISO88591_UTF8Conversion
NSS_Get_SEC_BMPStringTemplate_Util
NSS_Get_SEC_UTF8StringTemplate_Util
NSS_Get_SEC_SetOfAnyTemplate_Util
DER_LengthLength
DER_StoreHeader
NSS_Get_SEC_T61StringTemplate
NSS_Get_SEC_PrintableStringTemplate
SECITEM_Hash
NSS_Get_SEC_UniversalStringTemplate
PK11URI_CreateURI
NSSUTIL_MkNSSString
NSSUTIL_ArgParseCipherFlags
NSSUTIL_MkModuleSpec
NSSUTIL_ArgParseModuleSpecEx
NSSUTIL_MkSlotString
NSSUTIL_ArgParseSlotInfo
NSSUTIL_DoubleEscapeSize
NSSUTIL_Escape
NSSUTIL_EscapeSize
NSSUTIL_ArgReadLong
NSSUTIL_ArgHasFlag
NSSUTIL_ArgIsBlank
NSSUTIL_ArgDecodeNumber
NSSUTIL_ArgGetLabel
NSSUTIL_ArgSkipParameter
NSSUTIL_ArgGetParamValue
NSSUTIL_ArgStrip
NSSUTIL_ArgFetchValue
NSS_SetAlgorithmPolicy
SECOID_FindOIDByMechanism
PORT_LoadLibraryFromOrigin
PK11URI_GetPathAttribute
PK11URI_DestroyURI
PK11URI_ParseURI
SGN_DecodeDigestInfo
_SGN_VerifyPKCS1DigestInfo
NSS_Get_SEC_ObjectIDTemplate_Util
PORT_DestroyCheapArena
PORT_InitCheapArena
NSS_Get_SEC_BitStringTemplate_Util
NSS_GetAlgorithmPolicy
NSS_Get_SEC_SequenceOfObjectIDTemplate
NSS_Get_SECOID_AlgorithmIDTemplate_Util
NSS_Get_SEC_PointerToGeneralizedTimeTemplate
NSS_Get_SEC_SequenceOfAnyTemplate
NSS_Get_SEC_PointerToEnumeratedTemplate
NSS_Get_SEC_PointerToAnyTemplate_Util
NSS_Get_SEC_OctetStringTemplate_Util
NSS_Get_SEC_NullTemplate_Util
NSS_Get_SEC_EnumeratedTemplate
NSS_Get_SEC_IntegerTemplate_Util
NSS_Get_SEC_GeneralizedTimeTemplate_Util
DER_SetUInteger
NSS_Get_SEC_AnyTemplate_Util
NSSRWLock_HaveWriteLock_Util
NSSRWLock_UnlockWrite_Util
NSSRWLock_UnlockRead_Util
NSSRWLock_LockWrite_Util
NSSRWLock_LockRead_Util
NSSRWLock_Destroy_Util
NSSRWLock_New_Util
NSSBase64_EncodeItem_Util
NSSBase64_DecodeBuffer_Util
NSSBase64Encoder_Destroy_Util
NSSBase64Decoder_Destroy_Util
NSSBase64Encoder_Update_Util
NSSBase64Decoder_Update_Util
NSSBase64Encoder_Create_Util
NSSBase64Decoder_Create_Util
BTOA_ConvertItemToAscii_Util
ATOB_ConvertAsciiToItem_Util
ATOB_AsciiToData_Util
BTOA_DataToAscii_Util
SEC_ASN1LengthLength_Util
SEC_ASN1DecodeInteger_Util
SEC_ASN1EncodeUnsignedInteger_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeItem_Util
SEC_ASN1Encode_Util
SEC_ASN1EncoderClearTakeFromBuf_Util
SEC_ASN1EncoderSetTakeFromBuf_Util
SEC_ASN1EncoderClearStreaming_Util
SEC_ASN1EncoderSetStreaming_Util
SEC_ASN1EncoderClearNotifyProc_Util
SEC_ASN1EncoderSetNotifyProc_Util
SEC_ASN1EncoderAbort_Util
SEC_ASN1EncoderFinish_Util
SEC_ASN1EncoderUpdate_Util
SEC_ASN1EncoderStart_Util
SEC_QuickDERDecodeItem_Util
SEC_ASN1DecodeItem_Util
SEC_ASN1Decode_Util
SEC_ASN1DecoderClearNotifyProc_Util
SEC_ASN1DecoderSetNotifyProc_Util
SEC_ASN1DecoderClearFilterProc_Util
SEC_ASN1DecoderSetFilterProc_Util
SEC_ASN1DecoderAbort_Util
SEC_ASN1DecoderFinish_Util
SEC_ASN1DecoderUpdate_Util
SEC_ASN1DecoderStart_Util
DER_EncodeTimeChoice_Util
DER_DecodeTimeChoice_Util
CERT_GenTime2FormattedAscii_Util
DER_GeneralizedTimeToTime_Util
DER_TimeToGeneralizedTimeArena_Util
DER_TimeToGeneralizedTime_Util
DER_TimeChoiceDayToAscii_Util
DER_GeneralizedDayToAscii_Util
DER_UTCDayToAscii_Util
DER_UTCTimeToAscii_Util
DER_UTCTimeToTime_Util
DER_AsciiToTime_Util
DER_TimeToUTCTime_Util
DER_GetInteger_Util
DER_Lengths_Util
DER_Encode_Util
SGN_CompareDigestInfo_Util
SGN_CopyDigestInfo_Util
SGN_DestroyDigestInfo_Util
SGN_CreateDigestInfo_Util
SECOID_AddEntry_Util
SECOID_FindOIDTagDescription_Util
SECOID_CompareAlgorithmID_Util
SECOID_DestroyAlgorithmID_Util
SECOID_GetAlgorithmTag_Util
SECOID_CopyAlgorithmID_Util
SECOID_SetAlgorithmID_Util
SECOID_FindOIDByTag_Util
SECOID_FindOIDTag_Util
SECOID_FindOID_Util
SECITEM_ZfreeItem_Util
SECITEM_FreeItem_Util
SECITEM_ArenaDupItem_Util
SECITEM_DupItem_Util
SECITEM_CopyItem_Util
SECITEM_ItemsAreEqual_Util
SECITEM_CompareItem_Util
SECITEM_AllocItem_Util
NSS_PutEnv_Util
PORT_UCS2_UTF8Conversion_Util
PORT_SetUCS2_UTF8ConversionFunction_Util
PORT_UCS2_ASCIIConversion_Util
PORT_SetUCS2_ASCIIConversionFunction_Util
PORT_SetUCS4_UTF8ConversionFunction_Util
PORT_ArenaStrdup_Util
PORT_ArenaUnmark_Util
PORT_ArenaRelease_Util
PORT_ArenaMark_Util
PORT_ArenaGrow_Util
PORT_ArenaZAlloc_Util
PORT_ArenaAlloc_Util
PORT_FreeArena_Util
PORT_NewArena_Util
PORT_GetError_Util
PORT_ZFree_Util
NSSUTIL_DoubleEscape
NSS_InitializePRErrorTable
SECOID_Shutdown
SECOID_Init
PORT_SetError_Util
PORT_Strdup_Util
PORT_Free_Util
PORT_ZAlloc_Util
PORT_Realloc_Util
PORT_Alloc_Util

libplc4

PL_strfree
PL_strdup
PL_strnstr
PL_strstr
PL_strcat
PL_strlen
PL_strcatn
PL_strncpyz
PL_Base64Encode
PL_strncasecmp
PL_strcasecmp

libplds4

PL_HashString
PL_ArenaRelease
PL_ArenaAllocate
PL_FinishArenaPool
PL_InitArenaPool
PL_HashTableEnumerateEntries
PL_CompareValues
PL_HashTableLookup
PL_HashTableRemove
PL_HashTableAdd
PL_HashTableDestroy
PL_NewHashTable
PL_CompareStrings

libnspr4

PR_htons
PR_ErrorToString
PR_Send
PR_Shutdown
PR_Listen
PR_Bind
PR_Accept
PR_ConnectContinue
PR_FindFunctionSymbol
PR_DestroyRWLock
PR_Realloc
PR_Malloc
PR_GetThreadPrivate
PR_SetThreadPrivate
PR_NewThreadPrivateIndex
PR_Free
PR_Calloc
PR_sprintf_append
PR_GetError
PR_htonl
PR_ConvertIPv4AddrToIPv6
PR_NetAddrToString
PR_SetErrorText
PR_Sleep
PR_IntervalToMicroseconds
PR_IntervalToMilliseconds
PR_IntervalToSeconds
PR_LogPrint
PR_NewLogModule
PR_FindSymbol
PR_UnloadLibrary
PR_LoadLibrary
PR_CallOnceWithArg
PR_IntervalNow
PR_Poll
PR_ExitMonitor
PR_EnterMonitor
PR_DestroyMonitor
PR_NewMonitor
PR_InitializeNetAddr
PR_EnumerateHostEnt
PR_GetHostByName
PR_StringToNetAddr
PR_snprintf
PR_Recv
PR_Connect
PR_NewTCPSocket
PR_Write
PR_Close
PR_SecondsToInterval
PR_TicksPerSecond
PR_Now
PR_GetEnvSecure
PR_NotifyAllCondVar
PR_NotifyCondVar
PR_WaitCondVar
PR_NewCondVar
PR_Unlock
PR_Lock
PR_DestroyLock
PR_NewLock
PR_smprintf_free
PR_smprintf
PR_CallOnce

kernel32

ReadConsoleW
ReadFile
SetEndOfFile
CreateFileW
HeapSize
LoadLibraryW
OutputDebugStringW
WriteConsoleW
SetFilePointerEx
SetStdHandle
LoadLibraryExW
HeapReAlloc
HeapAlloc
GetModuleFileNameW
GetFileAttributesExW
LCMapStringW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcessHeap
GetStartupInfoW
GetFileType
GetStdHandle
RtlUnwind
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
WriteFile
FlushFileBuffers
CloseHandle
AreFileApisANSI
GetProcAddress
GetModuleHandleExW
ExitProcess
Sleep
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
DecodePointer
EncodePointer
MultiByteToWideChar
SetLastError
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
GetCommandLineA
IsProcessorFeaturePresent
IsDebuggerPresent
HeapFree
GetLastError
LeaveCriticalSection
EnterCriticalSection

Exports

Exports

ATOB_AsciiToData
ATOB_ConvertAsciiToItem
BTOA_ConvertItemToAscii
BTOA_DataToAscii
CERT_AddCertToListHead
CERT_AddCertToListSorted
CERT_AddCertToListTail
CERT_AddExtension
CERT_AddExtensionByOID
CERT_AddOCSPAcceptableResponses
CERT_AddOKDomainName
CERT_AddRDN
CERT_AllocCERTRevocationFlags
CERT_AsciiToName
CERT_CRLCacheRefreshIssuer
CERT_CacheCRL
CERT_CacheOCSPResponseFromSideChannel
CERT_CertChainFromCert
CERT_CertListFromCert
CERT_CertTimesValid
CERT_ChangeCertTrust
CERT_CheckCertUsage
CERT_CheckCertValidTimes
CERT_CheckNameSpace
CERT_CheckOCSPStatus
CERT_ClearOCSPCache
CERT_CompareAVA
CERT_CompareCerts
CERT_CompareName
CERT_CompareValidityTimes
CERT_CompleteCRLDecodeEntries
CERT_CopyName
CERT_CopyRDN
CERT_CreateAVA
CERT_CreateCertificate
CERT_CreateCertificateRequest
CERT_CreateEncodedOCSPErrorResponse
CERT_CreateEncodedOCSPSuccessResponse
CERT_CreateName
CERT_CreateOCSPCertID
CERT_CreateOCSPRequest
CERT_CreateOCSPSingleResponseGood
CERT_CreateOCSPSingleResponseRevoked
CERT_CreateOCSPSingleResponseUnknown
CERT_CreateRDN
CERT_CreateSubjectCertList
CERT_CreateValidity
CERT_DecodeAVAValue
CERT_DecodeAltNameExtension
CERT_DecodeAuthInfoAccessExtension
CERT_DecodeAuthKeyID
CERT_DecodeBasicConstraintValue
CERT_DecodeCRLDistributionPoints
CERT_DecodeCertificatePoliciesExtension
CERT_DecodeDERCrl
CERT_DecodeDERCrlWithFlags
CERT_DecodeGeneralName
CERT_DecodeNameConstraintsExtension
CERT_DecodeOCSPRequest
CERT_DecodeOCSPResponse
CERT_DecodeOidSequence
CERT_DecodePrivKeyUsagePeriodExtension
CERT_DecodeTrustString
CERT_DecodeUserNotice
CERT_DerNameToAscii
CERT_DestroyCERTRevocationFlags
CERT_DestroyCertArray
CERT_DestroyCertList
CERT_DestroyCertificate
CERT_DestroyCertificateList
CERT_DestroyCertificatePoliciesExtension
CERT_DestroyCertificateRequest
CERT_DestroyName
CERT_DestroyOCSPCertID
CERT_DestroyOCSPRequest
CERT_DestroyOCSPResponse
CERT_DestroyOidSequence
CERT_DestroyUserNotice
CERT_DestroyValidity
CERT_DisableOCSPChecking
CERT_DisableOCSPDefaultResponder
CERT_DistNamesFromCertList
CERT_DupCertList
CERT_DupCertificate
CERT_DupDistNames
CERT_EnableOCSPChecking
CERT_EnableOCSPDefaultResponder
CERT_EncodeAltNameExtension
CERT_EncodeAndAddBitStrExtension
CERT_EncodeAuthKeyID
CERT_EncodeBasicConstraintValue
CERT_EncodeCRLDistributionPoints
CERT_EncodeCertPoliciesExtension
CERT_EncodeGeneralName
CERT_EncodeInfoAccessExtension
CERT_EncodeInhibitAnyExtension
CERT_EncodeNameConstraintsExtension
CERT_EncodeNoticeReference
CERT_EncodeOCSPRequest
CERT_EncodePolicyConstraintsExtension
CERT_EncodePolicyMappingExtension
CERT_EncodeSubjectKeyID
CERT_EncodeUserNotice
CERT_ExtractPublicKey
CERT_FilterCertListByCANames
CERT_FilterCertListByUsage
CERT_FilterCertListForUserCerts
CERT_FindCRLEntryReasonExten
CERT_FindCRLNumberExten
CERT_FindCertByDERCert
CERT_FindCertByIssuerAndSN
CERT_FindCertByIssuerAndSNCX
CERT_FindCertByName
CERT_FindCertByNickname
CERT_FindCertByNicknameOrEmailAddr
CERT_FindCertByNicknameOrEmailAddrCX
CERT_FindCertByNicknameOrEmailAddrForUsage
CERT_FindCertByNicknameOrEmailAddrForUsageCX
CERT_FindCertBySubjectKeyID
CERT_FindCertExtension
CERT_FindCertIssuer
CERT_FindKeyUsageExtension
CERT_FindNameConstraintsExten
CERT_FindSMimeProfile
CERT_FindSubjectKeyIDExtension
CERT_FindUserCertByUsage
CERT_FindUserCertsByUsage
CERT_FinishCertificateRequestAttributes
CERT_FinishExtensions
CERT_ForcePostMethodForOCSP
CERT_FormatName
CERT_FreeDistNames
CERT_FreeNicknames
CERT_GenTime2FormattedAscii
CERT_GetAVATag
CERT_GetCertChainFromCert
CERT_GetCertEmailAddress
CERT_GetCertIsPerm
CERT_GetCertIsTemp
CERT_GetCertIssuerAndSN
CERT_GetCertNicknames
CERT_GetCertTimes
CERT_GetCertTrust
CERT_GetCertUid
CERT_GetCertificateNames
CERT_GetCertificateRequestExtensions
CERT_GetClassicOCSPDisabledPolicy
CERT_GetClassicOCSPEnabledHardFailurePolicy
CERT_GetClassicOCSPEnabledSoftFailurePolicy
CERT_GetCommonName
CERT_GetConstrainedCertificateNames
CERT_GetCountryName
CERT_GetDBContentVersion
CERT_GetDefaultCertDB
CERT_GetDomainComponentName
CERT_GetEncodedOCSPResponse
CERT_GetFirstEmailAddress
CERT_GetGeneralNameTypeFromString
CERT_GetImposedNameConstraints
CERT_GetLocalityName
CERT_GetNextEmailAddress
CERT_GetNextGeneralName
CERT_GetNextNameConstraint
CERT_GetOCSPAuthorityInfoAccessLocation
CERT_GetOCSPResponseStatus
CERT_GetOCSPStatusForCertID
CERT_GetOidString
CERT_GetOrgName
CERT_GetOrgUnitName
CERT_GetPKIXVerifyNistRevocationPolicy
CERT_GetPrevGeneralName
CERT_GetPrevNameConstraint
CERT_GetSSLCACerts
CERT_GetSlopTime
CERT_GetStateName
CERT_GetSubjectNameDigest
CERT_GetSubjectPublicKeyDigest
CERT_GetUsePKIXForValidation
CERT_GetValidDNSPatternsFromCert
CERT_Hexify
CERT_ImportCAChain
CERT_ImportCAChainTrusted
CERT_ImportCRL
CERT_ImportCerts
CERT_IsCACert
CERT_IsCADERCert
CERT_IsRootDERCert
CERT_IsUserCert
CERT_KeyFromDERCrl
CERT_MakeCANickname
CERT_MergeExtensions
CERT_NameToAscii
CERT_NameToAsciiInvertible
CERT_NewCertList
CERT_NewTempCertificate
CERT_NicknameStringsFromCertList
CERT_OCSPCacheSettings
CERT_OpenCertDBFilename
CERT_PKIXVerifyCert
CERT_PostOCSPRequest
CERT_RFC1485_EscapeAndQuote
CERT_RegisterAlternateOCSPAIAInfoCallBack
CERT_RemoveCertListNode
CERT_SaveSMimeProfile
CERT_SetOCSPDefaultResponder
CERT_SetOCSPFailureMode
CERT_SetOCSPTimeout
CERT_SetSlopTime
CERT_SetUsePKIXForValidation
CERT_StartCRLEntryExtensions
CERT_StartCRLExtensions
CERT_StartCertExtensions
CERT_StartCertificateRequestAttributes
CERT_UncacheCRL
CERT_VerifyCACertForUsage
CERT_VerifyCert
CERT_VerifyCertName
CERT_VerifyCertNow
CERT_VerifyCertificate
CERT_VerifyCertificateNow
CERT_VerifyOCSPResponseSignature
CERT_VerifySignedData
CERT_VerifySignedDataWithPublicKey
CERT_VerifySignedDataWithPublicKeyInfo
DER_AsciiToTime
DER_DecodeTimeChoice
DER_Encode
DER_EncodeTimeChoice
DER_GeneralizedDayToAscii
DER_GeneralizedTimeToTime
DER_GetInteger
DER_Lengths
DER_TimeChoiceDayToAscii
DER_TimeToGeneralizedTime
DER_TimeToGeneralizedTimeArena
DER_TimeToUTCTime
DER_UTCDayToAscii
DER_UTCTimeToAscii
DER_UTCTimeToTime
DSAU_DecodeDerSig
DSAU_DecodeDerSigToLen
DSAU_EncodeDerSig
DSAU_EncodeDerSigWithLen
HASH_Begin
HASH_Clone
HASH_Create
HASH_Destroy
HASH_End
HASH_GetHashObject
HASH_GetHashObjectByOidTag
HASH_GetHashTypeByOidTag
HASH_GetType
HASH_HashBuf
HASH_ResultLen
HASH_ResultLenByOidTag
HASH_ResultLenContext
HASH_Update
NSSBase64Decoder_Create
NSSBase64Decoder_Destroy
NSSBase64Decoder_Update
NSSBase64Encoder_Create
NSSBase64Encoder_Destroy
NSSBase64Encoder_Update
NSSBase64_DecodeBuffer
NSSBase64_EncodeItem
NSSRWLock_Destroy
NSSRWLock_HaveWriteLock
NSSRWLock_LockRead
NSSRWLock_LockWrite
NSSRWLock_New
NSSRWLock_UnlockRead
NSSRWLock_UnlockWrite
NSS_GetVersion
NSS_Get_CERT_CertificateRequestTemplate
NSS_Get_CERT_CertificateTemplate
NSS_Get_CERT_CrlTemplate
NSS_Get_CERT_IssuerAndSNTemplate
NSS_Get_CERT_NameTemplate
NSS_Get_CERT_SequenceOfCertExtensionTemplate
NSS_Get_CERT_SetOfSignedCrlTemplate
NSS_Get_CERT_SignedCrlTemplate
NSS_Get_CERT_SignedDataTemplate
NSS_Get_CERT_SubjectPublicKeyInfoTemplate
NSS_Get_CERT_TimeChoiceTemplate
NSS_Get_SECKEY_DSAPublicKeyTemplate
NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate
NSS_Get_SECKEY_PointerToEncryptedPrivateKeyInfoTemplate
NSS_Get_SECKEY_PointerToPrivateKeyInfoTemplate
NSS_Get_SECKEY_PrivateKeyInfoTemplate
NSS_Get_SECKEY_RSAPSSParamsTemplate
NSS_Get_SECKEY_RSAPublicKeyTemplate
NSS_Get_SECOID_AlgorithmIDTemplate
NSS_Get_SEC_AnyTemplate
NSS_Get_SEC_BMPStringTemplate
NSS_Get_SEC_BitStringTemplate
NSS_Get_SEC_BooleanTemplate
NSS_Get_SEC_GeneralizedTimeTemplate
NSS_Get_SEC_IA5StringTemplate
NSS_Get_SEC_IntegerTemplate
NSS_Get_SEC_NullTemplate
NSS_Get_SEC_ObjectIDTemplate
NSS_Get_SEC_OctetStringTemplate
NSS_Get_SEC_PointerToAnyTemplate
NSS_Get_SEC_PointerToOctetStringTemplate
NSS_Get_SEC_SetOfAnyTemplate
NSS_Get_SEC_SignedCertificateTemplate
NSS_Get_SEC_UTCTimeTemplate
NSS_Get_SEC_UTF8StringTemplate
NSS_Get_sgn_DigestInfoTemplate
NSS_Init
NSS_InitContext
NSS_InitReadWrite
NSS_InitWithMerge
NSS_Initialize
NSS_IsInitialized
NSS_NoDB_Init
NSS_OptionGet
NSS_OptionSet
NSS_PutEnv
NSS_RegisterShutdown
NSS_Shutdown
NSS_ShutdownContext
NSS_UnregisterShutdown
NSS_VersionCheck
PBE_CreateContext
PBE_DestroyContext
PBE_GenerateBits
PK11SDR_Decrypt
PK11SDR_Encrypt
PK11_AlgtagToMechanism
PK11_Authenticate
PK11_BlockData
PK11_ChangePW
PK11_CheckSSOPassword
PK11_CheckUserPassword
PK11_CipherOp
PK11_CloneContext
PK11_ConfigurePKCS11
PK11_ConvertSessionPrivKeyToTokenPrivKey
PK11_ConvertSessionSymKeyToTokenSymKey
PK11_CopySymKeyForSigning
PK11_CopyTokenPrivKeyToSessionPrivKey
PK11_CreateContextBySymKey
PK11_CreateDigestContext
PK11_CreateGenericObject
PK11_CreateManagedGenericObject
PK11_CreateMergeLog
PK11_CreatePBEAlgorithmID
PK11_CreatePBEParams
PK11_CreatePBEV2AlgorithmID
PK11_DEREncodePublicKey
PK11_Decrypt
PK11_DeleteTokenCertAndKey
PK11_DeleteTokenPrivateKey
PK11_DeleteTokenPublicKey
PK11_DeleteTokenSymKey
PK11_Derive
PK11_DeriveWithFlags
PK11_DeriveWithFlagsPerm
PK11_DeriveWithTemplate
PK11_DestroyContext
PK11_DestroyGenericObject
PK11_DestroyGenericObjects
PK11_DestroyMergeLog
PK11_DestroyObject
PK11_DestroyPBEParams
PK11_DestroyTokenObject
PK11_DigestBegin
PK11_DigestFinal
PK11_DigestKey
PK11_DigestOp
PK11_DoesMechanism
PK11_Encrypt
PK11_ExportDERPrivateKeyInfo
PK11_ExportEncryptedPrivKeyInfo
PK11_ExportEncryptedPrivateKeyInfo
PK11_ExportPrivKeyInfo
PK11_ExportPrivateKeyInfo
PK11_ExtractKeyValue
PK11_Finalize
PK11_FindBestKEAMatch
PK11_FindCertAndKeyByRecipientList
PK11_FindCertAndKeyByRecipientListNew
PK11_FindCertByIssuerAndSN
PK11_FindCertFromDERCert
PK11_FindCertFromDERCertItem
PK11_FindCertFromNickname
PK11_FindCertFromURI
PK11_FindCertInSlot
PK11_FindCertsFromEmailAddress
PK11_FindCertsFromNickname
PK11_FindCertsFromURI
PK11_FindFixedKey
PK11_FindGenericObjects
PK11_FindKeyByAnyCert
PK11_FindKeyByDERCert
PK11_FindKeyByKeyID
PK11_FindPrivateKeyFromCert
PK11_FindSlotByName
PK11_FindSlotsByNames
PK11_FortezzaHasKEA
PK11_FortezzaMapSig
PK11_FreeSlot
PK11_FreeSlotList
PK11_FreeSlotListElement
PK11_FreeSymKey
PK11_GenerateFortezzaIV
PK11_GenerateKeyPair
PK11_GenerateKeyPairWithFlags
PK11_GenerateKeyPairWithOpFlags
PK11_GenerateNewParam
PK11_GenerateRandom
PK11_GenerateRandomOnSlot
PK11_GetAllSlotsForCert
PK11_GetAllTokens
PK11_GetBestKeyLength
PK11_GetBestSlot
PK11_GetBestSlotMultiple
PK11_GetBestSlotMultipleWithAttributes
PK11_GetBestSlotWithAttributes
PK11_GetBestWrapMechanism
PK11_GetBlockSize
PK11_GetCertFromPrivateKey
PK11_GetCurrentWrapIndex
PK11_GetDefaultArray
PK11_GetDefaultFlags
PK11_GetDisabledReason
PK11_GetFirstSafe
PK11_GetIVLength
PK11_GetInternalKeySlot
PK11_GetInternalSlot
PK11_GetKeyData
PK11_GetKeyGen
PK11_GetKeyLength
PK11_GetKeyStrength
PK11_GetKeyType
PK11_GetLowLevelKeyIDForCert
PK11_GetLowLevelKeyIDForPrivateKey
PK11_GetMechanism
PK11_GetMinimumPwdLength
PK11_GetModInfo
PK11_GetModule
PK11_GetModuleID
PK11_GetModuleURI
PK11_GetNextGenericObject
PK11_GetNextSafe
PK11_GetNextSymKey
PK11_GetPBECryptoMechanism
PK11_GetPBEIV
PK11_GetPQGParamsFromPrivateKey
PK11_GetPadMechanism
PK11_GetPrevGenericObject
PK11_GetPrivateKeyNickname
PK11_GetPrivateModulusLen
PK11_GetPublicKeyNickname
PK11_GetSlotFromKey
PK11_GetSlotFromPrivateKey
PK11_GetSlotID
PK11_GetSlotInfo
PK11_GetSlotName
PK11_GetSlotPWValues
PK11_GetSlotSeries
PK11_GetSymKeyHandle
PK11_GetSymKeyNickname
PK11_GetSymKeyType
PK11_GetSymKeyUserData
PK11_GetTokenInfo
PK11_GetTokenName
PK11_GetTokenURI
PK11_GetWindow
PK11_GetWrapKey
PK11_HasAttributeSet
PK11_HasRootCerts
PK11_HashBuf
PK11_IVFromParam
PK11_ImportCRL
PK11_ImportCert
PK11_ImportCertForKey
PK11_ImportCertForKeyToSlot
PK11_ImportDERCert
PK11_ImportDERCertForKey
PK11_ImportDERPrivateKeyInfo
PK11_ImportDERPrivateKeyInfoAndReturnKey
PK11_ImportEncryptedPrivateKeyInfo
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey
PK11_ImportPrivateKeyInfo
PK11_ImportPrivateKeyInfoAndReturnKey
PK11_ImportPublicKey
PK11_ImportSymKey
PK11_ImportSymKeyWithFlags
PK11_InitPin
PK11_IsDisabled
PK11_IsFIPS
PK11_IsFriendly
PK11_IsHW
PK11_IsInternal
PK11_IsInternalKeySlot
PK11_IsLoggedIn
PK11_IsPresent
PK11_IsReadOnly

Sections

.text
Size: 732KB - Virtual size: 732KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 760B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nss/nssckbi.dll
.dll windows:6 windows x86 arch:x86

d17ac7cdb472a2598e82ffeb90da31f1

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:3a:37:a5:1c:46:82:3b:9b:27:ad:e5:db:bf:33:f1
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

18/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

Issuer

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Not Before

15/08/2017, 07:55

Not After

15/08/2028, 07:55

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/04/2015, 00:58

Not After

08/04/2025, 00:58

Subject

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

67:5d:80:83:17:8b:ca:57:d2:7c:05:67:6c:fd:6b:b7:c1:ac:1a:7c:ff:98:55:0b:17:48:b5:79:7d:48:99:7a
Signer

Actual PE Digest

67:5d:80:83:17:8b:ca:57:d2:7c:05:67:6c:fd:6b:b7:c1:ac:1a:7c:ff:98:55:0b:17:48:b5:79:7d:48:99:7a

Digest Algorithm

sha256

PE Digest Matches

true

67:5d:80:83:17:8b:ca:57:d2:7c:05:67:6c:fd:6b:b7:c1:ac:1a:7c:ff:98:55:0b:17:48:b5:79:7d:48:99:7a
Signer

Actual PE Digest

67:5d:80:83:17:8b:ca:57:d2:7c:05:67:6c:fd:6b:b7:c1:ac:1a:7c:ff:98:55:0b:17:48:b5:79:7d:48:99:7a

Digest Algorithm

sha256

PE Digest Matches

true

82:ca:ed:a1:2e:4d:5d:09:dd:8f:f2:24:c5:a9:6a:44:4e:4f:26:1a
Signer

Actual PE Digest

82:ca:ed:a1:2e:4d:5d:09:dd:8f:f2:24:c5:a9:6a:44:4e:4f:26:1a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libplc4

PL_strlen

libplds4

PL_FinishArenaPool
PL_InitArenaPool
PL_CompareValues
PL_HashTableEnumerateEntries
PL_HashTableLookup
PL_HashTableRemove
PL_HashTableAdd
PL_HashTableDestroy
PL_NewHashTable
PL_ArenaAllocate

libnspr4

PR_CallOnce
PR_GetThreadPrivate
PR_SetThreadPrivate
PR_NewThreadPrivateIndex
PR_Free
PR_Calloc
PR_Unlock
PR_Lock
PR_DestroyLock
PR_NewLock

kernel32

FreeEnvironmentStringsW
CreateFileW
CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
FlushFileBuffers
LCMapStringW
HeapSize
LoadLibraryW
OutputDebugStringW
GetStringTypeW
HeapReAlloc
HeapAlloc
RtlUnwind
LoadLibraryExW
GetCommandLineA
GetCurrentThreadId
GetLastError
SetLastError
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetProcessHeap
GetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
Sleep
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
IsDebuggerPresent
WriteFile
GetModuleFileNameW

Exports

Exports

C_GetFunctionList

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 268KB - Virtual size: 268KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nss/nssdbm3.dll
.dll windows:6 windows x86 arch:x86

2fb1457dd681d84ad203ecb755345ee2

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:3a:37:a5:1c:46:82:3b:9b:27:ad:e5:db:bf:33:f1
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

18/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

Issuer

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Not Before

15/08/2017, 07:55

Not After

15/08/2028, 07:55

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/04/2015, 00:58

Not After

08/04/2025, 00:58

Subject

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

bc:d3:1f:5b:df:fa:1c:e3:85:ca:f9:a8:f5:ba:d4:c9:d2:be:64:f6:d9:a3:54:e8:72:92:e2:51:24:6a:ec:78
Signer

Actual PE Digest

bc:d3:1f:5b:df:fa:1c:e3:85:ca:f9:a8:f5:ba:d4:c9:d2:be:64:f6:d9:a3:54:e8:72:92:e2:51:24:6a:ec:78

Digest Algorithm

sha256

PE Digest Matches

true

bc:d3:1f:5b:df:fa:1c:e3:85:ca:f9:a8:f5:ba:d4:c9:d2:be:64:f6:d9:a3:54:e8:72:92:e2:51:24:6a:ec:78
Signer

Actual PE Digest

bc:d3:1f:5b:df:fa:1c:e3:85:ca:f9:a8:f5:ba:d4:c9:d2:be:64:f6:d9:a3:54:e8:72:92:e2:51:24:6a:ec:78

Digest Algorithm

sha256

PE Digest Matches

true

45:c9:4c:15:e7:b2:27:83:5d:bb:e5:1f:0d:5f:7c:2a:b2:c3:66:85
Signer

Actual PE Digest

45:c9:4c:15:e7:b2:27:83:5d:bb:e5:1f:0d:5f:7c:2a:b2:c3:66:85

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libplds4

PL_HashTableEnumerateEntries
PL_HashTableLookup
PL_HashTableRemove
PL_HashTableAdd
PL_CompareValues
PL_NewHashTable
PL_HashTableDestroy

libnspr4

PR_Lock
PR_GetDirectorySeparator
PR_CallOnce
PR_GetLibraryFilePathname
PR_FindFunctionSymbol
PR_LoadLibraryWithFlags
PR_ExitMonitor
PR_SetError
PR_GetError
PR_OpenFile
PR_Close
PR_Read
PR_Write
PR_Delete
PR_Access
PR_MkDir
PR_smprintf
PR_smprintf_free
PR_NewLock
PR_DestroyLock
PR_Unlock
PR_GetEnvSecure
PR_ntohl
PR_htonl
PR_LoadLibrary
PR_UnloadLibrary
PR_FindSymbol
PR_Free
PR_Now
PR_NewMonitor
PR_DestroyMonitor
PR_EnterMonitor

nssutil3

SECITEM_CopyItem_Util
PORT_ArenaZAlloc_Util
PORT_ArenaAlloc_Util
PORT_FreeArena_Util
PORT_NewArena_Util
PORT_GetError_Util
SECITEM_DupItem_Util
PORT_Strdup_Util
NSS_Get_SECOID_AlgorithmIDTemplate_Util
NSSBase64_EncodeItem_Util
PORT_Free_Util
PORT_ZAlloc_Util
PORT_Alloc_Util
SECITEM_FreeItem_Util
SECITEM_ZfreeItem_Util
SEC_QuickDERDecodeItem_Util
SEC_ASN1EncodeItem_Util
SEC_ASN1EncodeInteger_Util
SECOID_FindOIDTag_Util
SECOID_FindOIDByTag_Util
SECOID_SetAlgorithmID_Util
SECOID_GetAlgorithmTag_Util
NSS_Get_SEC_OctetStringTemplate_Util
DER_SetUInteger
PORT_Realloc_Util
SECITEM_ItemsAreEqual_Util
SECITEM_HashCompare
SECOID_Init
SECOID_Shutdown
SECITEM_AllocItem_Util
DER_DecodeTimeChoice_Util
NSS_Get_SEC_AnyTemplate_Util
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_ObjectIDTemplate_Util
PORT_InitCheapArena
PORT_DestroyCheapArena
PORT_ArenaMark_Util
PORT_ArenaRelease_Util
PORT_ArenaUnmark_Util
PORT_ArenaStrdup_Util
SECITEM_CompareItem_Util
NSSUTIL_ArgGetParamValue
NSSUTIL_ArgHasFlag
NSSUTIL_ArgReadLong
NSSUTIL_Quote
NSSUTIL_ArgParseSlotFlags
NSSUTIL_ArgParseSlotInfo
NSSUTIL_MkSlotString
NSSUTIL_ArgParseModuleSpec
NSSUTIL_MkModuleSpec
NSSUTIL_ArgParseCipherFlags
NSSUTIL_MkNSSString
PORT_SetError_Util

kernel32

FlushFileBuffers
SetFilePointer
ReadConsoleW
ReadFile
SetEndOfFile
GetTimeZoneInformation
HeapSize
SetEnvironmentVariableA
WriteConsoleW
SetFilePointerEx
LoadLibraryW
OutputDebugStringW
CloseHandle
CreateFileW
GetCurrentDirectoryW
GetFullPathNameW
PeekNamedPipe
GetFileInformationByHandle
HeapReAlloc
RtlUnwind
LoadLibraryExW
LCMapStringW
CompareStringW
GetStringTypeW
GetConsoleMode
GetConsoleCP
GetModuleFileNameW
WriteFile
FileTimeToSystemTime
GetDriveTypeW
FindFirstFileExW
FindClose
FileTimeToLocalFileTime
Sleep
GetModuleHandleW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetStartupInfoW
DeleteCriticalSection
GetStdHandle
GetProcessHeap
AreFileApisANSI
GetProcAddress
GetModuleHandleExW
ExitProcess
DecodePointer
EncodePointer
SetLastError
WideCharToMultiByte
MultiByteToWideChar
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
InterlockedDecrement
InterlockedIncrement
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
GetFileType
SetStdHandle
HeapAlloc
HeapFree
GetLastError
IsProcessorFeaturePresent
GetCurrentThreadId
GetCommandLineA
DeleteFileW

Exports

Exports

legacy_AddSecmodDB
legacy_DeleteSecmodDB
legacy_Open
legacy_ReadSecmodDB
legacy_ReleaseSecmodDBData
legacy_SetCryptFunctions
legacy_Shutdown

Sections

.text
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nss/nssutil3.dll
.dll windows:6 windows x86 arch:x86

09e68fd27fe2de86195d0de92a6281cb

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:3a:37:a5:1c:46:82:3b:9b:27:ad:e5:db:bf:33:f1
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

18/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

Issuer

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Not Before

15/08/2017, 07:55

Not After

15/08/2028, 07:55

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/04/2015, 00:58

Not After

08/04/2025, 00:58

Subject

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e4:d5:4d:ce:9a:b2:62:8b:44:03:ce:42:18:75:85:d3:c4:2d:94:81:b9:f1:07:bb:f0:71:b9:0e:e6:38:a4:bd
Signer

Actual PE Digest

e4:d5:4d:ce:9a:b2:62:8b:44:03:ce:42:18:75:85:d3:c4:2d:94:81:b9:f1:07:bb:f0:71:b9:0e:e6:38:a4:bd

Digest Algorithm

sha256

PE Digest Matches

true

e4:d5:4d:ce:9a:b2:62:8b:44:03:ce:42:18:75:85:d3:c4:2d:94:81:b9:f1:07:bb:f0:71:b9:0e:e6:38:a4:bd
Signer

Actual PE Digest

e4:d5:4d:ce:9a:b2:62:8b:44:03:ce:42:18:75:85:d3:c4:2d:94:81:b9:f1:07:bb:f0:71:b9:0e:e6:38:a4:bd

Digest Algorithm

sha256

PE Digest Matches

true

3d:ac:f6:0d:d4:6e:fb:3e:a5:36:3c:cf:e0:b8:50:9b:4b:3e:ba:ea
Signer

Actual PE Digest

3d:ac:f6:0d:d4:6e:fb:3e:a5:36:3c:cf:e0:b8:50:9b:4b:3e:ba:ea

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

libplc4

PL_strlen
PL_strcasecmp
PL_strpbrk
PL_strncasecmp

libplds4

PL_FinishArenaPool
PL_FreeArenaPool
PL_InitArenaPool
PL_CompareValues
PL_ArenaAllocate
PL_HashTableLookup
PL_HashTableAdd
PL_HashTableDestroy
PL_NewHashTable
PL_ArenaGrow
PL_ArenaRelease
PL_ClearArenaPool
PL_HashTableLookupConst

libnspr4

PR_snprintf
PR_smprintf_free
PR_smprintf
PR_Access
PR_Rename
PR_Delete
PR_GetError
PR_FormatTime
PR_LocalTimeParameters
PR_GetEnvSecure
PR_GetDirectorySeparator
PR_GetLibraryFilePathname
PR_LoadLibraryWithFlags
PR_GetCurrentThread
PR_NotifyAllCondVar
PR_NotifyCondVar
PR_WaitCondVar
PR_DestroyCondVar
PR_NewCondVar
PR_Unlock
PR_Lock
PR_DestroyLock
PR_NewLock
PR_Free
PR_Realloc
PR_Calloc
PR_Malloc
PR_SetError
PR_CallOnce
PR_ErrorInstallTable
PR_GMTParameters
PR_ImplodeTime
PR_ExplodeTime

kernel32

InterlockedDecrement
GetTimeZoneInformation
HeapSize
LoadLibraryW
OutputDebugStringW
HeapReAlloc
GetCurrentDirectoryW
GetFullPathNameW
PeekNamedPipe
GetFileInformationByHandle
LoadLibraryExW
GetModuleFileNameW
SetEndOfFile
WriteConsoleW
SetFilePointerEx
ReadConsoleW
ReadFile
FlushFileBuffers
HeapAlloc
LCMapStringW
CompareStringW
GetStringTypeW
Sleep
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
GetProcessHeap
FileTimeToSystemTime
GetDriveTypeW
FindFirstFileExW
FindClose
FileTimeToLocalFileTime
SetStdHandle
AreFileApisANSI
GetModuleHandleExW
ExitProcess
CreateFileW
SetEnvironmentVariableA
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
EncodePointer
InterlockedIncrement
SetEnvironmentVariableW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetLastError
MultiByteToWideChar
WideCharToMultiByte
DecodePointer
EnterCriticalSection
LeaveCriticalSection
CloseHandle
HeapFree
GetStdHandle
GetFileType
DeleteCriticalSection
RtlUnwind
WriteFile
GetConsoleCP
GetConsoleMode

Exports

Exports

ATOB_AsciiToData_Util
ATOB_ConvertAsciiToItem_Util
BTOA_ConvertItemToAscii_Util
BTOA_DataToAscii_Util
CERT_GenTime2FormattedAscii_Util
DER_AsciiToTime_Util
DER_DecodeTimeChoice_Util
DER_EncodeTimeChoice_Util
DER_Encode_Util
DER_GeneralizedDayToAscii_Util
DER_GeneralizedTimeToTime_Util
DER_GetInteger_Util
DER_GetUInteger
DER_LengthLength
DER_Lengths_Util
DER_SetUInteger
DER_StoreHeader
DER_TimeChoiceDayToAscii_Util
DER_TimeToGeneralizedTimeArena_Util
DER_TimeToGeneralizedTime_Util
DER_TimeToUTCTime_Util
DER_UTCDayToAscii_Util
DER_UTCTimeToAscii_Util
DER_UTCTimeToTime_Util
NSSBase64Decoder_Create_Util
NSSBase64Decoder_Destroy_Util
NSSBase64Decoder_Update_Util
NSSBase64Encoder_Create_Util
NSSBase64Encoder_Destroy_Util
NSSBase64Encoder_Update_Util
NSSBase64_DecodeBuffer_Util
NSSBase64_EncodeItem_Util
NSSRWLock_Destroy_Util
NSSRWLock_HaveWriteLock_Util
NSSRWLock_LockRead_Util
NSSRWLock_LockWrite_Util
NSSRWLock_New_Util
NSSRWLock_UnlockRead_Util
NSSRWLock_UnlockWrite_Util
NSSUTIL_ArgDecodeNumber
NSSUTIL_ArgFetchValue
NSSUTIL_ArgGetLabel
NSSUTIL_ArgGetParamValue
NSSUTIL_ArgHasFlag
NSSUTIL_ArgIsBlank
NSSUTIL_ArgParseCipherFlags
NSSUTIL_ArgParseModuleSpec
NSSUTIL_ArgParseModuleSpecEx
NSSUTIL_ArgParseSlotFlags
NSSUTIL_ArgParseSlotInfo
NSSUTIL_ArgReadLong
NSSUTIL_ArgSkipParameter
NSSUTIL_ArgStrip
NSSUTIL_DoModuleDBFunction
NSSUTIL_DoubleEscape
NSSUTIL_DoubleEscapeSize
NSSUTIL_Escape
NSSUTIL_EscapeSize
NSSUTIL_GetVersion
NSSUTIL_MkModuleSpec
NSSUTIL_MkNSSString
NSSUTIL_MkSlotString
NSSUTIL_Quote
NSSUTIL_QuoteSize
NSS_GetAlgorithmPolicy
NSS_Get_SECOID_AlgorithmIDTemplate_Util
NSS_Get_SEC_AnyTemplate_Util
NSS_Get_SEC_BMPStringTemplate_Util
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_BooleanTemplate_Util
NSS_Get_SEC_EnumeratedTemplate
NSS_Get_SEC_GeneralizedTimeTemplate_Util
NSS_Get_SEC_IA5StringTemplate_Util
NSS_Get_SEC_IntegerTemplate_Util
NSS_Get_SEC_NullTemplate_Util
NSS_Get_SEC_ObjectIDTemplate_Util
NSS_Get_SEC_OctetStringTemplate_Util
NSS_Get_SEC_PointerToAnyTemplate_Util
NSS_Get_SEC_PointerToEnumeratedTemplate
NSS_Get_SEC_PointerToGeneralizedTimeTemplate
NSS_Get_SEC_PointerToOctetStringTemplate_Util
NSS_Get_SEC_PrintableStringTemplate
NSS_Get_SEC_SequenceOfAnyTemplate
NSS_Get_SEC_SequenceOfObjectIDTemplate
NSS_Get_SEC_SetOfAnyTemplate_Util
NSS_Get_SEC_SkipTemplate
NSS_Get_SEC_T61StringTemplate
NSS_Get_SEC_UTF8StringTemplate_Util
NSS_Get_SEC_UniversalStringTemplate
NSS_Get_sgn_DigestInfoTemplate_Util
NSS_InitializePRErrorTable
NSS_PutEnv_Util
NSS_SecureMemcmp
NSS_SecureMemcmpZero
NSS_SetAlgorithmPolicy
PK11URI_CreateURI
PK11URI_DestroyURI
PK11URI_FormatURI
PK11URI_GetPathAttribute
PK11URI_GetQueryAttribute
PK11URI_ParseURI
PORT_Alloc_Util
PORT_ArenaAlloc_Util
PORT_ArenaGrow_Util
PORT_ArenaMark_Util
PORT_ArenaRelease_Util
PORT_ArenaStrdup_Util
PORT_ArenaUnmark_Util
PORT_ArenaZAlloc_Util
PORT_DestroyCheapArena
PORT_FreeArena_Util
PORT_Free_Util
PORT_GetError_Util
PORT_ISO88591_UTF8Conversion
PORT_InitCheapArena
PORT_LoadLibraryFromOrigin
PORT_NewArena_Util
PORT_Realloc_Util
PORT_RegExpCaseSearch
PORT_RegExpSearch
PORT_RegExpValid
PORT_SetError_Util
PORT_SetUCS2_ASCIIConversionFunction_Util
PORT_SetUCS2_UTF8ConversionFunction_Util
PORT_SetUCS4_UTF8ConversionFunction_Util
PORT_Strdup_Util
PORT_UCS2_ASCIIConversion_Util
PORT_UCS2_UTF8Conversion_Util
PORT_UCS4_UTF8Conversion
PORT_ZAllocAlignedOffset_Util
PORT_ZAllocAligned_Util
PORT_ZAlloc_Util
PORT_ZFree_Util
SECITEM_AllocArray
SECITEM_AllocItem_Util
SECITEM_ArenaDupItem_Util
SECITEM_CompareItem_Util
SECITEM_CopyItem_Util
SECITEM_DupArray
SECITEM_DupItem_Util
SECITEM_FreeArray
SECITEM_FreeItem_Util
SECITEM_Hash
SECITEM_HashCompare
SECITEM_ItemsAreEqual_Util
SECITEM_ReallocItem
SECITEM_ReallocItemV2
SECITEM_ZfreeArray
SECITEM_ZfreeItem_Util
SECOID_AddEntry_Util
SECOID_CompareAlgorithmID_Util
SECOID_CopyAlgorithmID_Util
SECOID_DestroyAlgorithmID_Util
SECOID_FindOIDByMechanism
SECOID_FindOIDByTag_Util
SECOID_FindOIDTagDescription_Util
SECOID_FindOIDTag_Util
SECOID_FindOID_Util
SECOID_GetAlgorithmTag_Util
SECOID_Init
SECOID_KnownCertExtenOID
SECOID_SetAlgorithmID_Util
SECOID_Shutdown
SEC_ASN1DecodeInteger_Util
SEC_ASN1DecodeItem_Util
SEC_ASN1Decode_Util
SEC_ASN1DecoderAbort_Util
SEC_ASN1DecoderClearFilterProc_Util
SEC_ASN1DecoderClearNotifyProc_Util
SEC_ASN1DecoderFinish_Util
SEC_ASN1DecoderSetFilterProc_Util
SEC_ASN1DecoderSetMaximumElementSize
SEC_ASN1DecoderSetNotifyProc_Util
SEC_ASN1DecoderStart_Util
SEC_ASN1DecoderUpdate_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeItem_Util
SEC_ASN1EncodeUnsignedInteger_Util
SEC_ASN1Encode_Util
SEC_ASN1EncoderAbort_Util
SEC_ASN1EncoderClearNotifyProc_Util
SEC_ASN1EncoderClearStreaming_Util
SEC_ASN1EncoderClearTakeFromBuf_Util
SEC_ASN1EncoderFinish_Util
SEC_ASN1EncoderSetNotifyProc_Util
SEC_ASN1EncoderSetStreaming_Util
SEC_ASN1EncoderSetTakeFromBuf_Util
SEC_ASN1EncoderStart_Util
SEC_ASN1EncoderUpdate_Util
SEC_ASN1LengthLength_Util
SEC_QuickDERDecodeItem_Util
SEC_StringToOID
SGN_CompareDigestInfo_Util
SGN_CopyDigestInfo_Util
SGN_CreateDigestInfo_Util
SGN_DecodeDigestInfo
SGN_DestroyDigestInfo_Util
UTIL_SetForkState
_NSSUTIL_EvaluateConfigDir
_NSSUTIL_GetSecmodName
_SGN_VerifyPKCS1DigestInfo

Sections

.text
Size: 126KB - Virtual size: 125KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nss/plc4.dll
.dll windows:4 windows x86 arch:x86

117580383d9705e2154f4772a3d7b5cb

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:cc:37:35:e9:ec:1f:c9:71:67:0e:73:e3:69:c7:91
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

30/10/2009, 00:00

Not After

30/10/2010, 23:59

Subject

CN=Mozilla Corporation,OU=Release Engineering,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b3:03:ff:94:52:5a:be:91:2c:c2:93:9c:e7:37:00:5e:7d:cf:59:64:04:a7:64:1f:97:e9:9e:2e:99:a7:f7:d7
Signer

Actual PE Digest

b3:03:ff:94:52:5a:be:91:2c:c2:93:9c:e7:37:00:5e:7d:cf:59:64:04:a7:64:1f:97:e9:9e:2e:99:a7:f7:d7

Digest Algorithm

sha256

PE Digest Matches

true

cc:70:80:81:64:7c:aa:20:f6:e7:7c:79:78:8d:b5:cc:58:67:d6:7a
Signer

Actual PE Digest

cc:70:80:81:64:7c:aa:20:f6:e7:7c:79:78:8d:b5:cc:58:67:d6:7a

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\builds\moz2_slave\win32_build\build\obj-firefox\nsprpub\lib\libc\src\plc4.pdb

Imports

nspr4

PR_SetError
PR_Calloc
PR_GetSpecialFD
PR_GetError
PR_GetOSError
PR_ErrorToName
PR_fprintf
PR_Free
PR_Malloc

mozcrt19

strrchr
strpbrk
strstr
_encode_pointer
_malloc_crt
strchr
_decode_pointer
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_crt_debugger_hook
strncmp
free
memcpy
malloc
_encoded_null

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
QueryPerformanceCounter

Exports

Exports

PL_Base64Decode
PL_Base64Encode
PL_CreateLongOptState
PL_CreateOptState
PL_DestroyOptState
PL_FPrintError
PL_GetNextOpt
PL_PrintError
PL_strcasecmp
PL_strcaserstr
PL_strcasestr
PL_strcat
PL_strcatn
PL_strchr
PL_strcmp
PL_strcpy
PL_strdup
PL_strfree
PL_strlen
PL_strncasecmp
PL_strncaserstr
PL_strncasestr
PL_strncat
PL_strnchr
PL_strncmp
PL_strncpy
PL_strncpyz
PL_strndup
PL_strnlen
PL_strnpbrk
PL_strnprbrk
PL_strnrchr
PL_strnrstr
PL_strnstr
PL_strpbrk
PL_strprbrk
PL_strrchr
PL_strrstr
PL_strstr
PL_strtok_r
libVersionPoint

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nss/plds4.dll
.dll windows:4 windows x86 arch:x86

b39362cc8da8c2533578c138bce5d210

Code Sign

01
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

01/08/1996, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

0a
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

06/08/2003, 00:00

Not After

05/08/2013, 23:59

Subject

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

25:cc:37:35:e9:ec:1f:c9:71:67:0e:73:e3:69:c7:91
Certificate

Issuer

CN=Thawte Code Signing CA,O=Thawte Consulting (Pty) Ltd.,C=ZA

Not Before

30/10/2009, 00:00

Not After

30/10/2010, 23:59

Subject

CN=Mozilla Corporation,OU=Release Engineering,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageMicrosoftCommercialCodeSigning

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1c:97:59:e7:c2:dd:9b:9f:e8:48:b6:bc:f2:dc:e8:6f:3f:f7:e1:9e:d6:1a:ba:73:44:05:7d:d1:42:e8:de:11
Signer

Actual PE Digest

1c:97:59:e7:c2:dd:9b:9f:e8:48:b6:bc:f2:dc:e8:6f:3f:f7:e1:9e:d6:1a:ba:73:44:05:7d:d1:42:e8:de:11

Digest Algorithm

sha256

PE Digest Matches

true

ff:5e:b7:34:6c:7a:5f:eb:d7:1b:94:2c:62:fd:b8:88:c0:01:4d:5d
Signer

Actual PE Digest

ff:5e:b7:34:6c:7a:5f:eb:d7:1b:94:2c:62:fd:b8:88:c0:01:4d:5d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

e:\builds\moz2_slave\win32_build\build\obj-firefox\nsprpub\lib\ds\plds4.pdb

Imports

nspr4

PR_DestroyLock
PR_Free
PR_Malloc
PR_CeilingLog2
PR_Unlock
PR_CallOnce
PR_Lock
PR_NewLock

mozcrt19

_decode_pointer
_initterm
_encoded_null
_amsg_exit
_adjust_fdiv
__CppXcptFilter
__clean_type_info_names_internal
_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_crt_debugger_hook
free
_malloc_crt
_encode_pointer
memset
memcpy
_initterm_e

kernel32

IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
QueryPerformanceCounter
DisableThreadLibraryCalls
InterlockedCompareExchange
Sleep
InterlockedExchange
GetTickCount

Exports

Exports

PL_ArenaAllocate
PL_ArenaFinish
PL_ArenaGrow
PL_ArenaRelease
PL_CompactArenaPool
PL_CompareStrings
PL_CompareValues
PL_FinishArenaPool
PL_FreeArenaPool
PL_HashString
PL_HashTableAdd
PL_HashTableDestroy
PL_HashTableDump
PL_HashTableEnumerateEntries
PL_HashTableLookup
PL_HashTableLookupConst
PL_HashTableRawAdd
PL_HashTableRawLookup
PL_HashTableRawLookupConst
PL_HashTableRawRemove
PL_HashTableRemove
PL_InitArenaPool
PL_NewHashTable
libVersionPoint

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 964B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 736B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 524B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nss/smime3.dll
.dll windows:6 windows x86 arch:x86

d8efb351c18dc92d5b6bd7686a7a91a4

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:3a:37:a5:1c:46:82:3b:9b:27:ad:e5:db:bf:33:f1
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

18/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

Issuer

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Not Before

15/08/2017, 07:55

Not After

15/08/2028, 07:55

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/04/2015, 00:58

Not After

08/04/2025, 00:58

Subject

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

ae:f6:9d:b8:82:44:1b:06:95:6b:d5:f6:61:f9:4e:cf:5d:e0:7c:40:e1:a8:2c:7f:00:a1:a9:60:4d:57:c6:98
Signer

Actual PE Digest

ae:f6:9d:b8:82:44:1b:06:95:6b:d5:f6:61:f9:4e:cf:5d:e0:7c:40:e1:a8:2c:7f:00:a1:a9:60:4d:57:c6:98

Digest Algorithm

sha256

PE Digest Matches

true

ae:f6:9d:b8:82:44:1b:06:95:6b:d5:f6:61:f9:4e:cf:5d:e0:7c:40:e1:a8:2c:7f:00:a1:a9:60:4d:57:c6:98
Signer

Actual PE Digest

ae:f6:9d:b8:82:44:1b:06:95:6b:d5:f6:61:f9:4e:cf:5d:e0:7c:40:e1:a8:2c:7f:00:a1:a9:60:4d:57:c6:98

Digest Algorithm

sha256

PE Digest Matches

true

f1:8d:92:b5:f7:1a:2b:73:08:b2:0a:25:34:a0:09:ef:51:71:55:d8
Signer

Actual PE Digest

f1:8d:92:b5:f7:1a:2b:73:08:b2:0a:25:34:a0:09:ef:51:71:55:d8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

nss3

PK11_PBEKeyGen
NSS_OptionGet
CERT_NewTempCertificate
__CERT_DecodeDERCertificate
CERT_IsCADERCert
CERT_IsRootDERCert
PK11_GetTokenName
PK11_ImportPublicKey
PK11_ImportPrivateKeyInfo
PK11_ImportEncryptedPrivateKeyInfo
PK11_ReferenceSlot
PK11_ImportDERCert
PK11_TraverseCertsForSubjectInSlot
PK11_ImportCertForKeyToSlot
PK11_TraverseCertsForNicknameInSlot
PK11_CreatePBEV2AlgorithmID
PK11_FindCertAndKeyByRecipientList
HASH_ResultLen
HASH_GetHashTypeByOidTag
SECKEY_CopyEncryptedPrivateKeyInfo
SECKEY_CopyPrivateKeyInfo
SECKEY_DestroyEncryptedPrivateKeyInfo
SECKEY_DestroyPrivateKeyInfo
NSS_Get_SECKEY_PointerToPrivateKeyInfoTemplate
SEC_PKCS5GetKeyLength
SEC_PKCS5GetCryptoAlgorithm
PK11_DigestFinal
PK11_DigestOp
PK11_HashBuf
PK11_DigestBegin
PK11_GenerateRandom
NSS_Get_SECKEY_PointerToEncryptedPrivateKeyInfoTemplate
NSS_Get_SECKEY_PrivateKeyInfoTemplate
NSS_VersionCheck
SECKEY_PublicKeyStrengthInBits
CERT_FindSMimeProfile
HASH_GetHashObjectByOidTag
NSS_RegisterShutdown
VFY_VerifyDataDirect
VFY_VerifyDigestDirect
SEC_GetSignatureAlgorithmOidTag
SGN_Digest
SEC_SignData
PK11_FindKeyByAnyCert
CERT_SaveSMimeProfile
CERT_CertListFromCert
CERT_GetCommonName
PK11_DestroyPBEParams
NSS_Get_CERT_IssuerAndSNTemplate
CERT_FindCertByIssuerAndSN
CERT_GetDefaultCertDB
CERT_FilterCertListByUsage
CERT_AddCertToListTail
CERT_DestroyCertList
CERT_NewCertList
CERT_ImportCerts
CERT_DestroyCertArray
CERT_DestroyCertificateList
CERT_CertChainFromCert
CERT_VerifyCert
CERT_FindCertByDERCert
PK11_FindPrivateKeyFromCert
SECKEY_DestroyPrivateKey
SECKEY_CreateSubjectPublicKeyInfo
SECKEY_CopyPublicKey
SECKEY_CopyPrivateKey
SECKEY_DestroySubjectPublicKeyInfo
CERT_FindSubjectKeyIDExtension
CERT_GetCertIssuerAndSN
CERT_DupCertificate
CERT_DestroyCertificate
PK11_PubUnwrapSymKey
PK11_PubWrapSymKey
SECKEY_GetPublicKeyType
SECKEY_DestroyPublicKey
SECKEY_PublicKeyStrength
CERT_ExtractPublicKey
PK11_SetPasswordFunc
PK11_FindCertAndKeyByRecipientListNew
PK11_KeyGen
PK11_GetBestSlot
SEC_PKCS5IsAlgorithmPBEAlgTag
PK11_CreatePBEAlgorithmID
SEC_PKCS5IsAlgorithmPBEAlg
PK11_GetPBECryptoMechanism
PK11_CipherOp
PK11_CreateContextBySymKey
PK11_DestroyContext
PK11_GetSlotFromKey
PK11_GetSymKeyUserData
PK11_ParamToAlgid
PK11_AlgtagToMechanism
PK11_GenerateNewParam
PK11_ParamFromAlgid
PK11_GetBlockSize
PK11_IsHW
PK11_FreeSlot
PK11_GetKeyStrength
PK11_ReferenceSymKey
PK11_CreatePBEParams
PK11_ExportEncryptedPrivateKeyInfo
PK11_ExportPrivateKeyInfo
PK11_SetSymKeyUserData
PK11_IsInternal
PK11_GetInternalSlot
CERT_FindCertBySubjectKeyID
PK11_GetInternalKeySlot
PK11_FreeSymKey
NSS_Get_CERT_TimeChoiceTemplate
NSS_Get_CERT_SetOfSignedCrlTemplate
PK11_FindKeyByDERCert

nssutil3

SEC_ASN1Encode_Util
SEC_ASN1EncoderAbort_Util
SEC_ASN1DecoderAbort_Util
ATOB_ConvertAsciiToItem_Util
ATOB_AsciiToData_Util
SEC_ASN1DecoderClearNotifyProc_Util
SECITEM_DupItem_Util
PORT_ZFree_Util
PORT_ArenaStrdup_Util
NSS_Get_SEC_BMPStringTemplate_Util
DER_GetInteger_Util
SGN_CopyDigestInfo_Util
SEC_ASN1DecodeItem_Util
SGN_DestroyDigestInfo_Util
SGN_CreateDigestInfo_Util
NSS_Get_SEC_PointerToAnyTemplate_Util
SECITEM_ZfreeItem_Util
SECITEM_CompareItem_Util
PORT_UCS2_UTF8Conversion_Util
PORT_UCS2_ASCIIConversion_Util
PORT_Realloc_Util
NSS_Get_sgn_DigestInfoTemplate_Util
SECOID_CompareAlgorithmID_Util
SECITEM_ItemsAreEqual_Util
DER_EncodeTimeChoice_Util
DER_DecodeTimeChoice_Util
PORT_Strdup_Util
SECOID_FindOIDTag_Util
SEC_ASN1DecodeInteger_Util
SEC_QuickDERDecodeItem_Util
SEC_ASN1EncoderClearTakeFromBuf_Util
SEC_ASN1EncoderSetTakeFromBuf_Util
SEC_ASN1EncoderClearStreaming_Util
SEC_ASN1EncoderSetStreaming_Util
SEC_ASN1EncoderClearNotifyProc_Util
SEC_ASN1EncoderSetNotifyProc_Util
SEC_ASN1EncoderFinish_Util
SEC_ASN1EncoderUpdate_Util
SEC_ASN1EncoderStart_Util
SECOID_DestroyAlgorithmID_Util
PORT_FreeArena_Util
PORT_NewArena_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1DecoderSetNotifyProc_Util
SEC_ASN1DecoderClearFilterProc_Util
SEC_ASN1DecoderSetFilterProc_Util
SEC_ASN1DecoderFinish_Util
SEC_ASN1DecoderStart_Util
PORT_GetError_Util
PORT_Alloc_Util
SECITEM_FreeItem_Util
SECOID_GetAlgorithmTag_Util
SECOID_CopyAlgorithmID_Util
SECOID_SetAlgorithmID_Util
SECITEM_AllocItem_Util
PORT_Free_Util
PORT_ZAlloc_Util
NSS_Get_SEC_ObjectIDTemplate_Util
NSS_Get_SEC_IA5StringTemplate_Util
NSS_Get_SEC_AnyTemplate_Util
SEC_ASN1EncodeItem_Util
SECOID_FindOIDByTag_Util
SECOID_FindOID_Util
SECITEM_ArenaDupItem_Util
SECITEM_CopyItem_Util
PORT_ArenaUnmark_Util
PORT_ArenaRelease_Util
PORT_ArenaMark_Util
PORT_SetError_Util
NSS_Get_SEC_SetOfAnyTemplate_Util
NSS_Get_SEC_PointerToOctetStringTemplate_Util
NSS_Get_SEC_OctetStringTemplate_Util
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SECOID_AlgorithmIDTemplate_Util
PORT_ArenaGrow_Util
PORT_ArenaZAlloc_Util
PORT_ArenaAlloc_Util
SEC_ASN1DecoderUpdate_Util

libplc4

PL_strncasecmp

libplds4

PL_HashTableDestroy
PL_NewHashTable
PL_HashTableAdd
PL_HashTableLookupConst
PL_CompareValues

libnspr4

PR_Unlock
PR_Now
PR_NewLock
PR_DestroyLock
PR_CallOnce
PR_Lock

kernel32

CloseHandle
WriteConsoleW
SetFilePointerEx
SetStdHandle
GetConsoleMode
GetConsoleCP
GetCommandLineA
GetCurrentThreadId
IsProcessorFeaturePresent
IsDebuggerPresent
GetLastError
SetLastError
InterlockedIncrement
InterlockedDecrement
EncodePointer
DecodePointer
ExitProcess
GetModuleHandleExW
GetProcAddress
MultiByteToWideChar
GetProcessHeap
GetStdHandle
GetFileType
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetStartupInfoW
GetModuleFileNameA
HeapFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
FreeEnvironmentStringsW
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
Sleep
EnterCriticalSection
LeaveCriticalSection
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WriteFile
GetModuleFileNameW
LoadLibraryExW
RtlUnwind
HeapAlloc
HeapReAlloc
GetStringTypeW
OutputDebugStringW
LoadLibraryW
HeapSize
LCMapStringW
FlushFileBuffers
CreateFileW

Exports

Exports

CERT_ConvertAndDecodeCertificate
CERT_DecodeCertFromPackage
CERT_DecodeCertPackage
NSSSMIME_GetVersion
NSSSMIME_VersionCheck
NSS_CMSContentInfo_GetBulkKey
NSS_CMSContentInfo_GetBulkKeySize
NSS_CMSContentInfo_GetContent
NSS_CMSContentInfo_GetContentEncAlgTag
NSS_CMSContentInfo_GetContentTypeTag
NSS_CMSContentInfo_SetBulkKey
NSS_CMSContentInfo_SetContent
NSS_CMSContentInfo_SetContentEncAlg
NSS_CMSContentInfo_SetContent_Data
NSS_CMSContentInfo_SetContent_DigestedData
NSS_CMSContentInfo_SetContent_EncryptedData
NSS_CMSContentInfo_SetContent_EnvelopedData
NSS_CMSContentInfo_SetContent_SignedData
NSS_CMSContentInfo_SetDontStream
NSS_CMSDEREncode
NSS_CMSDecoder_Cancel
NSS_CMSDecoder_Finish
NSS_CMSDecoder_Start
NSS_CMSDecoder_Update
NSS_CMSDigestContext_Cancel
NSS_CMSDigestContext_FinishMultiple
NSS_CMSDigestContext_FinishSingle
NSS_CMSDigestContext_StartMultiple
NSS_CMSDigestContext_StartSingle
NSS_CMSDigestContext_Update
NSS_CMSDigestedData_Create
NSS_CMSDigestedData_Destroy
NSS_CMSDigestedData_GetContentInfo
NSS_CMSEncoder_Cancel
NSS_CMSEncoder_Finish
NSS_CMSEncoder_Start
NSS_CMSEncoder_Update
NSS_CMSEncryptedData_Create
NSS_CMSEncryptedData_Destroy
NSS_CMSEncryptedData_GetContentInfo
NSS_CMSEnvelopedData_AddRecipient
NSS_CMSEnvelopedData_Create
NSS_CMSEnvelopedData_Destroy
NSS_CMSEnvelopedData_GetContentInfo
NSS_CMSMessage_ContentLevel
NSS_CMSMessage_ContentLevelCount
NSS_CMSMessage_Copy
NSS_CMSMessage_Create
NSS_CMSMessage_CreateFromDER
NSS_CMSMessage_Destroy
NSS_CMSMessage_GetContent
NSS_CMSMessage_GetContentInfo
NSS_CMSMessage_IsEncrypted
NSS_CMSMessage_IsSigned
NSS_CMSRecipientInfo_Create
NSS_CMSRecipientInfo_CreateFromDER
NSS_CMSRecipientInfo_CreateNew
NSS_CMSRecipientInfo_CreateWithSubjKeyID
NSS_CMSRecipientInfo_CreateWithSubjKeyIDFromCert
NSS_CMSRecipientInfo_Destroy
NSS_CMSRecipientInfo_Encode
NSS_CMSRecipientInfo_GetCertAndKey
NSS_CMSRecipientInfo_UnwrapBulkKey
NSS_CMSRecipientInfo_WrapBulkKey
NSS_CMSSignedData_AddCertChain
NSS_CMSSignedData_AddCertList
NSS_CMSSignedData_AddCertificate
NSS_CMSSignedData_AddDigest
NSS_CMSSignedData_AddSignerInfo
NSS_CMSSignedData_Create
NSS_CMSSignedData_CreateCertsOnly
NSS_CMSSignedData_Destroy
NSS_CMSSignedData_GetContentInfo
NSS_CMSSignedData_GetDigestAlgs
NSS_CMSSignedData_GetSignerInfo
NSS_CMSSignedData_HasDigests
NSS_CMSSignedData_ImportCerts
NSS_CMSSignedData_SetDigestValue
NSS_CMSSignedData_SetDigests
NSS_CMSSignedData_SignerInfoCount
NSS_CMSSignedData_VerifyCertsOnly
NSS_CMSSignedData_VerifySignerInfo
NSS_CMSSignerInfo_AddMSSMIMEEncKeyPrefs
NSS_CMSSignerInfo_AddSMIMECaps
NSS_CMSSignerInfo_AddSMIMEEncKeyPrefs
NSS_CMSSignerInfo_AddSigningTime
NSS_CMSSignerInfo_Create
NSS_CMSSignerInfo_CreateWithSubjKeyID
NSS_CMSSignerInfo_Destroy
NSS_CMSSignerInfo_GetCertList
NSS_CMSSignerInfo_GetSignerCommonName
NSS_CMSSignerInfo_GetSignerEmailAddress
NSS_CMSSignerInfo_GetSigningCertificate
NSS_CMSSignerInfo_GetSigningTime
NSS_CMSSignerInfo_GetVerificationStatus
NSS_CMSSignerInfo_GetVersion
NSS_CMSSignerInfo_IncludeCerts
NSS_CMSSignerInfo_Verify
NSS_CMSType_RegisterContentType
NSS_CMSUtil_VerificationStatusToString
NSS_Get_NSSCMSGenericWrapperDataTemplate
NSS_Get_NSS_PointerToCMSGenericWrapperDataTemplate
NSS_SMIMESignerInfo_SaveSMIMEProfile
NSS_SMIMEUtil_CreateMSSMIMEEncKeyPrefs
NSS_SMIMEUtil_FindBulkAlgForRecipients
SECMIME_DecryptionAllowed
SEC_PKCS12AddCertAndKey
SEC_PKCS12AddCertOrChainAndKey
SEC_PKCS12AddPasswordIntegrity
SEC_PKCS12CreateExportContext
SEC_PKCS12CreatePasswordPrivSafe
SEC_PKCS12CreateUnencryptedSafe
SEC_PKCS12DecoderFinish
SEC_PKCS12DecoderGetCerts
SEC_PKCS12DecoderImportBags
SEC_PKCS12DecoderIterateInit
SEC_PKCS12DecoderIterateNext
SEC_PKCS12DecoderRenameCertNicknames
SEC_PKCS12DecoderSetTargetTokenCAs
SEC_PKCS12DecoderStart
SEC_PKCS12DecoderUpdate
SEC_PKCS12DecoderValidateBags
SEC_PKCS12DecoderVerify
SEC_PKCS12DecryptionAllowed
SEC_PKCS12DestroyExportContext
SEC_PKCS12EnableCipher
SEC_PKCS12Encode
SEC_PKCS12IsEncryptionAllowed
SEC_PKCS12SetPreferredCipher
SEC_PKCS7AddCertificate
SEC_PKCS7AddRecipient
SEC_PKCS7AddSigningTime
SEC_PKCS7ContainsCertsOrCrls
SEC_PKCS7ContentIsEncrypted
SEC_PKCS7ContentIsSigned
SEC_PKCS7ContentType
SEC_PKCS7CopyContentInfo
SEC_PKCS7CreateCertsOnly
SEC_PKCS7CreateData
SEC_PKCS7CreateEncryptedData
SEC_PKCS7CreateEnvelopedData
SEC_PKCS7CreateSignedData
SEC_PKCS7DecodeItem
SEC_PKCS7DecoderAbort
SEC_PKCS7DecoderFinish
SEC_PKCS7DecoderStart
SEC_PKCS7DecoderUpdate
SEC_PKCS7DecryptContents
SEC_PKCS7DestroyContentInfo
SEC_PKCS7Encode
SEC_PKCS7EncodeItem
SEC_PKCS7EncoderAbort
SEC_PKCS7EncoderFinish
SEC_PKCS7EncoderStart
SEC_PKCS7EncoderUpdate
SEC_PKCS7GetCertificateList
SEC_PKCS7GetContent
SEC_PKCS7GetEncryptionAlgorithm
SEC_PKCS7GetSignerCommonName
SEC_PKCS7GetSignerEmailAddress
SEC_PKCS7GetSigningTime
SEC_PKCS7IncludeCertChain
SEC_PKCS7IsContentEmpty
SEC_PKCS7SetContent
SEC_PKCS7VerifyDetachedSignature
SEC_PKCS7VerifyDetachedSignatureAtTime
SEC_PKCS7VerifySignature

Sections

.text
Size: 95KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nss/softokn3.dll
.dll windows:6 windows x86 arch:x86

f70a32deba7052fe3a6b49399127d186

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:3a:37:a5:1c:46:82:3b:9b:27:ad:e5:db:bf:33:f1
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

18/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

Issuer

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Not Before

15/08/2017, 07:55

Not After

15/08/2028, 07:55

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/04/2015, 00:58

Not After

08/04/2025, 00:58

Subject

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f9:8e:f9:77:41:97:09:09:e2:01:20:1e:68:8a:bc:31:bd:63:0e:38:09:af:29:52:74:c5:85:72:f0:1a:8e:01
Signer

Actual PE Digest

f9:8e:f9:77:41:97:09:09:e2:01:20:1e:68:8a:bc:31:bd:63:0e:38:09:af:29:52:74:c5:85:72:f0:1a:8e:01

Digest Algorithm

sha256

PE Digest Matches

true

f9:8e:f9:77:41:97:09:09:e2:01:20:1e:68:8a:bc:31:bd:63:0e:38:09:af:29:52:74:c5:85:72:f0:1a:8e:01
Signer

Actual PE Digest

f9:8e:f9:77:41:97:09:09:e2:01:20:1e:68:8a:bc:31:bd:63:0e:38:09:af:29:52:74:c5:85:72:f0:1a:8e:01

Digest Algorithm

sha256

PE Digest Matches

true

64:29:91:e8:1c:dd:81:1c:ce:11:52:21:2a:d9:21:1c:51:b1:4d:c8
Signer

Actual PE Digest

64:29:91:e8:1c:dd:81:1c:ce:11:52:21:2a:d9:21:1c:51:b1:4d:c8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

sqlite3

sqlite3_file_control
sqlite3_reset
sqlite3_finalize
sqlite3_column_int
sqlite3_column_bytes
sqlite3_column_blob
sqlite3_step
sqlite3_bind_text
sqlite3_bind_int
sqlite3_bind_blob
sqlite3_prepare_v2
sqlite3_open
sqlite3_free
sqlite3_mprintf
sqlite3_busy_timeout
sqlite3_exec
sqlite3_close

nssutil3

SECITEM_CompareItem_Util
NSSUTIL_ArgHasFlag
NSSUTIL_ArgIsBlank
NSSUTIL_ArgDecodeNumber
NSSUTIL_ArgGetLabel
NSSUTIL_ArgSkipParameter
NSSUTIL_ArgStrip
NSSUTIL_ArgFetchValue
_NSSUTIL_EvaluateConfigDir
PORT_Strdup_Util
SECOID_FindOIDByMechanism
SGN_DestroyDigestInfo_Util
SGN_CreateDigestInfo_Util
DER_Encode_Util
_SGN_VerifyPKCS1DigestInfo
NSS_Get_SEC_OctetStringTemplate_Util
SEC_QuickDERDecodeItem_Util
_NSSUTIL_GetSecmodName
NSSUTIL_DoModuleDBFunction
UTIL_SetForkState
SECOID_Shutdown
DER_SetUInteger
SECITEM_HashCompare
PORT_ArenaAlloc_Util
PORT_GetError_Util
PORT_ArenaGrow_Util
PORT_Realloc_Util
SECOID_DestroyAlgorithmID_Util
SECOID_GetAlgorithmTag_Util
SECOID_CopyAlgorithmID_Util
SECOID_SetAlgorithmID_Util
DER_GetInteger_Util
SEC_ASN1EncodeInteger_Util
SEC_ASN1EncodeItem_Util
SEC_ASN1DecodeItem_Util
SECITEM_ZfreeItem_Util
SECITEM_FreeItem_Util
SECITEM_DupItem_Util
SECITEM_AllocItem_Util
PORT_ZFree_Util
PORT_ZAlloc_Util
SECITEM_CopyItem_Util
PORT_ArenaZAlloc_Util
PORT_FreeArena_Util
PORT_NewArena_Util
NSS_Get_SECOID_AlgorithmIDTemplate_Util
NSS_Get_SEC_ObjectIDTemplate_Util
NSS_Get_SEC_BitStringTemplate_Util
NSS_Get_SEC_AnyTemplate_Util
PORT_Free_Util
PORT_Alloc_Util
SECOID_Init
PORT_SetError_Util

libplc4

PL_strcasecmp
PL_strncasecmp

libplds4

PL_HashTableLookup
PL_CompareValues
PL_HashTableAdd
PL_HashTableDestroy
PL_NewHashTable
PL_HashTableEnumerateEntries
PL_HashTableRemove
PL_HashTableLookupConst

libnspr4

PR_CallOnce
PR_SetError
PR_snprintf
PR_GetEnv
PR_LoadLibraryWithFlags
PR_UnloadLibrary
PR_FindFunctionSymbol
PR_GetLibraryFilePathname
PR_Lock
PR_Unlock
PR_GetDirectorySeparator
PR_GetEnvSecure
PR_SecondsToInterval
PR_NewLock
PR_DestroyLock
PR_Sleep
PR_smprintf_free
PR_IntervalNow
PR_MillisecondsToInterval
PR_GetCurrentThread
PR_Now
PR_Access
PR_NewMonitor
PR_DestroyMonitor
PR_EnterMonitor
PR_ExitMonitor
PR_smprintf
PR_Free

kernel32

SetFileAttributesW
GetFileAttributesExW
CloseHandle
CreateFileW
FlushFileBuffers
HeapSize
WriteConsoleW
SetStdHandle
HeapReAlloc
RtlUnwind
LoadLibraryW
OutputDebugStringW
LoadLibraryExW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
LCMapStringW
GetStringTypeW
LeaveCriticalSection
EnterCriticalSection
Sleep
WideCharToMultiByte
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetModuleFileNameA
DeleteCriticalSection
GetFileType
GetModuleFileNameW
WriteFile
GetStdHandle
AreFileApisANSI
GetModuleHandleExW
ExitProcess
GetProcessHeap
DecodePointer
EncodePointer
GetProcAddress
GetModuleHandleW
GetStartupInfoW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
TerminateProcess
GetCurrentProcess
InitializeCriticalSectionAndSpinCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
MultiByteToWideChar
SetLastError
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
GetCommandLineA
HeapAlloc
HeapFree
GetLastError
IsProcessorFeaturePresent
IsDebuggerPresent
GetTempPathA

Exports

Exports

C_GetFunctionList
FC_GetFunctionList
NSC_GetFunctionList
NSC_ModuleDBFunc

Sections

.text
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nss/sqlite3.dll
.dll windows:6 windows x86 arch:x86

cc0ecd1133ed618f0910ed145b35fd6a

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:3a:37:a5:1c:46:82:3b:9b:27:ad:e5:db:bf:33:f1
Certificate

Issuer

CN=Thawte Code Signing CA - G2,O=Thawte\, Inc.,C=US

Not Before

18/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

25:1f:5d:98:81:82:17:2e:3c:41:9e:01:4f:b0:40:4c
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2024, 01:00

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0b:29:2e:ea:2a:38:95:aa:8e:6d:99:32:43:f0:70:22
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

26/09/2018, 00:00

Not After

18/10/2019, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

6d:79:16:4f:42:57:0d:7a:07:0b:5e:c7:60:39:7c:47
Certificate

Issuer

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Not Before

15/08/2017, 07:55

Not After

15/08/2028, 07:55

Subject

CN=WoSign Time Stamping Signer,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

51:ec:ef:d7:72:99:ba:1a:dd:28:02:43:1e:86:e2:0e
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/04/2015, 00:58

Not After

08/04/2025, 00:58

Subject

CN=WoSign Time Stamping Services CA G2,O=WoSign CA Limited,C=CN

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5e:68:d6:11:71:94:63:50:56:00:68:f3:3e:c9:c5:91
Certificate

Issuer

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Not Before

08/08/2009, 01:00

Not After

08/08/2039, 01:00

Subject

CN=Certification Authority of WoSign,O=WoSign CA Limited,C=CN

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

65:ce:ba:1d:23:c6:ae:34:c0:0d:1c:14:6b:6d:f4:1a:ce:11:60:2a:70:37:9c:5e:ea:a1:47:df:15:8b:00:2b
Signer

Actual PE Digest

65:ce:ba:1d:23:c6:ae:34:c0:0d:1c:14:6b:6d:f4:1a:ce:11:60:2a:70:37:9c:5e:ea:a1:47:df:15:8b:00:2b

Digest Algorithm

sha256

PE Digest Matches

true

65:ce:ba:1d:23:c6:ae:34:c0:0d:1c:14:6b:6d:f4:1a:ce:11:60:2a:70:37:9c:5e:ea:a1:47:df:15:8b:00:2b
Signer

Actual PE Digest

65:ce:ba:1d:23:c6:ae:34:c0:0d:1c:14:6b:6d:f4:1a:ce:11:60:2a:70:37:9c:5e:ea:a1:47:df:15:8b:00:2b

Digest Algorithm

sha256

PE Digest Matches

true

c5:e8:c5:a4:d2:4d:d5:16:6c:57:32:83:d5:49:9f:d9:c7:0a:fb:56
Signer

Actual PE Digest

c5:e8:c5:a4:d2:4d:d5:16:6c:57:32:83:d5:49:9f:d9:c7:0a:fb:56

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

DeleteFileA
AreFileApisANSI
GetSystemTime
LocalFree
GetTempPathA
GetCurrentProcessId
DeleteFileW
CloseHandle
GetVersionExA
OutputDebugStringA
GetFileAttributesExW
GetSystemInfo
GetDiskFreeSpaceA
CreateFileMappingW
CreateFileMappingA
LoadLibraryA
GetDiskFreeSpaceW
LockFileEx
HeapSize
GetProcAddress
GetLastError
GetTempPathW
FlushFileBuffers
MultiByteToWideChar
CreateFileW
ReadFile
GetFileAttributesW
HeapValidate
HeapCreate
GetFileAttributesA
HeapDestroy
GetVersionExW
FormatMessageW
Sleep
LoadLibraryW
WideCharToMultiByte
WriteFile
FormatMessageA
GetSystemTimeAsFileTime
GetProcessHeap
UnlockFileEx
GetTickCount
OutputDebugStringW
WaitForSingleObjectEx
LockFile
FlushViewOfFile
UnlockFile
InterlockedCompareExchange
WaitForSingleObject
HeapFree
QueryPerformanceCounter
SystemTimeToFileTime
HeapAlloc
FreeLibrary
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
SetFilePointer
HeapCompact
CreateMutexW
GetFileSize
CreateFileA
HeapReAlloc
GetFullPathNameA
GetFullPathNameW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
IsDebuggerPresent
IsProcessorFeaturePresent
EncodePointer
DecodePointer
CreateThread
ExitThread
LoadLibraryExW
GetCommandLineA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
InterlockedDecrement
ExitProcess
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
GetTimeZoneInformation
InterlockedIncrement
GetFileType
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
RtlUnwind
CompareStringW
LCMapStringW
GetStringTypeW
GetConsoleCP
GetConsoleMode
SetEnvironmentVariableA
SetStdHandle
SetFilePointerEx
WriteConsoleW

Exports

Exports

sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_bind_blob
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_value
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_complete
sqlite3_complete16
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_module
sqlite3_data_count
sqlite3_db_handle
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_exec
sqlite3_expired
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_load_extension
sqlite3_malloc
sqlite3_mprintf
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_realloc
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_value
sqlite3_rollback_hook
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_sleep
sqlite3_snprintf
sqlite3_step
sqlite3_thread_cleanup
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vmprintf
sqlite3_wal_checkpoint

Sections

.text
Size: 517KB - Virtual size: 517KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 57KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/7z/7z.dll
.dll windows:4 windows x86 arch:x86

6a7be52633b01426b17d148203c82793

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

oleaut32

SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear

user32

CharPrevExA
CharUpperW

msvcrt

_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
exit
strchr
strcat
strcpy
memset
realloc
free
malloc
strlen
wcscmp
strcmp
strstr
_CxxThrowException
memmove
memcpy
memcmp
_purecall
__CxxFrameHandler

kernel32

InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
SetThreadAffinityMask
ResumeThread
WaitForSingleObject
InterlockedIncrement
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
LoadLibraryW
FreeLibrary
QueryPerformanceCounter
GetOEMCP
FileTimeToLocalFileTime
DeleteCriticalSection
GetVersionExW
LocalFileTimeToFileTime
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
CompareFileTime
GetLastError
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
GetProcAddress
GetModuleHandleW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetModuleHandleA

Exports

Exports

CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode

Sections

.text
Size: 878KB - Virtual size: 877KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/7z/7z.exe
.exe windows:4 windows x86 arch:x86

8c1dd070b13c63abc19b1534fe4b4867

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

SysStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear

user32

CharUpperW

advapi32

LookupPrivilegeValueW
GetFileSecurityW
SetFileSecurityW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
OpenProcessToken

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_beginthreadex
_ftol
memcmp
_purecall
memset
strlen
wcscmp
wcsstr
strcmp
memmove
fputs
fputc
fflush
fgetc
fclose
_iob
free
_CxxThrowException
malloc
memcpy
__CxxFrameHandler
_isatty
_fileno

kernel32

SetThreadAffinityMask
CreateEventW
SetEvent
InitializeCriticalSection
WaitForSingleObject
SetFileTime
VirtualFree
VirtualAlloc
SetConsoleMode
GetConsoleMode
GetVersionExW
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetProcessTimes
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetProcessAffinityMask
GetStdHandle
GetSystemTimeAsFileTime
FileTimeToDosDateTime
IsProcessorFeaturePresent
GlobalMemoryStatus
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetCurrentProcess
GetDiskFreeSpaceW
SetEndOfFile
WriteFile
ReadFile
DeviceIoControl
SetFilePointer
GetFileSize
GetLogicalDriveStringsW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryExW
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
CreateFileW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
DeleteFileW
SetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleA
GetFileAttributesW
GetFileInformationByHandle
ResumeThread

Sections

.text
Size: 251KB - Virtual size: 251KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NDC-Probe/ConsoleApp.deps.json
plugins/NDC-Probe/ConsoleApp.dll
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

11:35:ef:af:a6:00:81:14:c4:1e:54:ef:e7:c3:2c:91:fc:20:0c:01:03:70:d1:e3:1e:e6:0b:ea:ac:3f:70:5b
Signer

Actual PE Digest

11:35:ef:af:a6:00:81:14:c4:1e:54:ef:e7:c3:2c:91:fc:20:0c:01:03:70:d1:e3:1e:e6:0b:ea:ac:3f:70:5b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\zhi-c\source\repos\ConsoleApp\obj\Release\netcoreapp3.1\ConsoleApp.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NDC-Probe/ConsoleApp.runtimeconfig.json
plugins/NDC-Probe/README.txt
plugins/NSecSnip/NxSnip.exe
.exe windows:5 windows x86 arch:x86

c5d857544491d7f7a7dc1d23f3c9031b

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0f:84:f9:11:d4:1b:e4:59:d1:78:85:a1:67:8c:70:4d:7c:96:f1:98:20:de:84:66:f1:ef:6f:9b:b5:ae:ce:dc
Signer

Actual PE Digest

0f:84:f9:11:d4:1b:e4:59:d1:78:85:a1:67:8c:70:4d:7c:96:f1:98:20:de:84:66:f1:ef:6f:9b:b5:ae:ce:dc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\Nsec\Release\Client\NxSnip.pdb

Imports

kernel32

SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
SetConsoleMode
ReadConsoleA
InterlockedExchangeAdd
GetVersion
DeleteFiber
SwitchToFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GlobalMemoryStatus
GetEnvironmentVariableW
SetStdHandle
GetCurrentProcess
GlobalUnlock
GlobalLock
GlobalAlloc
InterlockedIncrement
CreateDirectoryW
DosDateTimeToFileTime
SystemTimeToFileTime
DuplicateHandle
SetFileTime
SetFilePointer
WriteFile
GetFileType
GetACP
CreateFileW
GetFileSize
GetCurrentDirectoryW
LoadLibraryW
FindResourceW
LoadResource
LockResource
FreeResource
SizeofResource
SetCurrentDirectoryW
ReleaseMutex
CreateMutexW
GetComputerNameW
MulDiv
GetLocalTime
Sleep
GetCurrentThreadId
OutputDebugStringA
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetTickCount
WideCharToMultiByte
GetModuleHandleW
SleepEx
DeleteCriticalSection
GetProcAddress
DecodePointer
GetSystemInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
GetConsoleCP
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
WriteConsoleW
GetStdHandle
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
MoveFileExW
FormatMessageW
SetLastError
SystemTimeToTzSpecificLocalTime
RtlUnwind
LoadLibraryExW
FileTimeToSystemTime
OpenProcess
FindClose
DeviceIoControl
FindNextFileW
FindFirstFileW
SetFilePointerEx
GetSystemDirectoryA
GetFileSizeEx
FlushFileBuffers
FormatMessageA
GetSystemTime
FreeLibrary
LockFileEx
CreateFileMappingA
UnlockFile
HeapDestroy
HeapCompact
HeapReAlloc
GetVersionExA
LoadLibraryA
FlushViewOfFile
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
GetVersionExW
GetFileAttributesW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
LockFile
GetDiskFreeSpaceW
InterlockedCompareExchange
GetFullPathNameW
HeapCreate
TryEnterCriticalSection
AreFileApisANSI
DeleteFileA
GetDriveTypeW
CreateEventW
SwitchToThread
RaiseException
CloseHandle
CompareFileTime
GetEnvironmentVariableA
WaitForMultipleObjects
VerSetConditionMask
ExitProcess
VerifyVersionInfoW
SetFileAttributesW
MapViewOfFile
CreateFileMappingW
GetModuleFileNameA
GetPrivateProfileStringA
GetProcessHeap
SetFileAttributesA
HeapAlloc
CreateFileA
GetVolumeInformationA
GetDriveTypeA
HeapFree
GetLogicalDrives
LocalFree
InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
DeleteFileW
OutputDebugStringW
GetLastError
MultiByteToWideChar
GetModuleHandleA
WaitForSingleObject
PeekNamedPipe
WaitForSingleObjectEx
InterlockedDecrement
ResetEvent
SetEvent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
GetStringTypeW
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
GetSystemTimeAsFileTime
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
TerminateProcess
ReadFile

user32

SetPropW
GetPropW
wsprintfA
SetCaretPos
MonitorFromWindow
ShowCaret
HideCaret
GetCaretBlinkTime
GetMonitorInfoW
IsClipboardFormatAvailable
AppendMenuW
wsprintfW
GetGUIThreadInfo
InvalidateRgn
CreateAcceleratorTableW
DrawIconEx
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
GetSysColor
CreateCaret
ReleaseDC
GetDC
PtInRect
GetDesktopWindow
SetCursor
SetClipboardData
LoadCursorW
EmptyClipboard
CloseClipboard
OpenClipboard
GetWindowRect
DrawTextW
SetProcessDPIAware
FindWindowW
SendMessageW
EnableWindow
GetCursorPos
PostQuitMessage
SetFocus
DestroyMenu
GetForegroundWindow
ClientToScreen
TrackPopupMenu
CreatePopupMenu
SetWindowPos
PostMessageW
GetKeyState
ChildWindowFromPointEx
ScreenToClient
IntersectRect
GetMessageW
TranslateMessage
DispatchMessageW
CreateWindowExW
IsWindow
DestroyWindow
IsWindowVisible
IsIconic
CharNextW
GetActiveWindow
GetFocus
SetCapture
ReleaseCapture
SetTimer
KillTimer
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
MapWindowPoints
UnionRect
IsRectEmpty
GetWindowLongW
SetWindowLongW
GetParent
GetWindow
CharPrevW
FillRect
SetRect
wvsprintfW
OffsetRect
DefWindowProcW
RegisterClassExW
ShowWindow
MoveWindow
CallWindowProcW
RegisterClassW
GetClassInfoExW
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
GetCaretPos

gdi32

CreateSolidBrush
GetCharABCWidthsW
GetClipBox
LineTo
RoundRect
SelectClipRgn
ExtSelectClipRgn
SetBkColor
StretchBlt
CreateRectRgnIndirect
MoveToEx
TextOutW
ExtTextOutW
GdiFlush
CreatePatternBrush
GetPixel
SetPixel
CreatePenIndirect
CombineRgn
SetWindowOrgEx
SaveDC
RestoreDC
Rectangle
GetTextExtentPoint32W
GetStockObject
CreatePen
CreateFontIndirectW
GetDIBits
SetTextColor
SetBkMode
CreateDIBSection
GetTextMetricsW
GetObjectA
CreateRoundRectRgn
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
DeleteDC
SetStretchBltMode
SelectObject
CreateFontW
GetBitmapBits
GetDeviceCaps
GetObjectW
DeleteObject
CreateBitmap

comdlg32

GetSaveFileNameW

advapi32

CryptCreateHash
RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
RegCloseKey
SetSecurityDescriptorDacl
GetTokenInformation
RegQueryValueExW
GetUserNameW
ConvertSidToStringSidW
RegOpenKeyExA
OpenProcessToken
RegQueryValueExA
SetFileSecurityW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CryptEnumProvidersW
CryptReleaseContext
CryptDestroyKey
CryptGetProvParam
CryptAcquireContextW
CryptGetUserKey
CryptExportKey
CryptGenRandom
CryptDecrypt
CryptSetHashParam
CryptSignHashW
CryptDestroyHash

shell32

SHCreateDirectoryExW
SHCreateDirectoryExA
SHGetSpecialFolderPathW

ole32

CreateStreamOnHGlobal
OleLockRunning
CLSIDFromProgID
CLSIDFromString
CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantInit

shlwapi

PathFileExistsA
SHSetValueA
SHDeleteValueA
SHSetValueW
wnsprintfW
PathFileExistsW
PathAppendW
wnsprintfA
PathFindExtensionW
PathFindFileNameA
wvnsprintfA
PathAppendA

netapi32

NetApiBufferFree
NetUserGetInfo
Netbios

gdiplus

GdiplusShutdown
GdiplusStartup
GdipCreateLineBrushI
GdipGetImageGraphicsContext
GdipCreateBitmapFromScan0
GdipSetPixelOffsetMode
GdipSetInterpolationMode
GdipGraphicsClear
GdipDrawImage
GdipDeletePath
GdipDeleteFontFamily
GdipGetFamily
GdipSetStringFormatLineAlign
GdipSetPathFillMode
GdipAddPathEllipseI
GdipAddPathPieI
GdipFillPath
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize
GdipGetPropertyItem
GdipCreatePath
GdipCreateSolidFill
GdipSetPenWidth
GdipAddPathLineI
GdipFillPolygonI
GdipCreateTexture
GdipCreatePen2
GdipDrawLineI
GdipCreateStringFormat
GdipSetCompositingQuality
GdipCreateFontFromLogfontA
GdipDeleteBrush
GdipSetSmoothingMode
GdipGetPenBrushFill
GdipCreateFontFromDC
GdipDrawString
GdipResetWorldTransform
GdipCreateFromHDC
GdipSetTextRenderingHint
GdipRotateWorldTransform
GdipCloneBrush
GdipDeleteGraphics
GdipDeleteStringFormat
GdipDeleteFont
GdipDrawRectangleI
GdipTranslateWorldTransform
GdipDeletePen
GdipCreatePen1
GdipSetStringFormatAlign
GdipGetPenFillType
GdipGetImageEncoders
GdipCloneImage
GdipAlloc
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipFree
GdipGetImageEncodersSize
GdipSaveImageToFile
GdipDrawPath
GdipDrawEllipseI
GdipDrawImageRectI

msimg32

AlphaBlend

comctl32

ord17
_TrackMouseEvent

imm32

ImmAssociateContext
ImmReleaseContext
ImmGetContext
ImmSetCompositionFontW
ImmSetCompositionWindow

ws2_32

getnameinfo
shutdown
ioctlsocket
WSAEnumNetworkEvents
listen
htonl
sendto
recvfrom
accept
select
__WSAFDIsSet
WSACleanup
WSAStartup
ntohs
getsockopt
getsockname
getpeername
WSAEventSelect
send
bind
WSAIoctl
closesocket
WSACloseEvent
WSACreateEvent
WSASetLastError
inet_addr
socket
connect
recv
htons
setsockopt
WSAGetLastError
gethostbyname
inet_ntoa
gethostname
freeaddrinfo
getaddrinfo

crypt32

CertFindCertificateInStore
CertCloseStore
CertOpenStore
CertFreeCertificateContext
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertDuplicateCertificateContext

wldap32

ord216
ord46
ord14
ord301
ord147
ord133
ord79
ord219
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord145

iphlpapi

GetAdaptersAddresses

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 549KB - Virtual size: 548KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 527KB - Virtual size: 527KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/7z.dll
.dll windows:4 windows x86 arch:x86

6a7be52633b01426b17d148203c82793

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

oleaut32

SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear

user32

CharPrevExA
CharUpperW

msvcrt

_adjust_fdiv
_initterm
_onexit
__dllonexit
?terminate@@YAXXZ
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
exit
strchr
strcat
strcpy
memset
realloc
free
malloc
strlen
wcscmp
strcmp
strstr
_CxxThrowException
memmove
memcpy
memcmp
_purecall
__CxxFrameHandler

kernel32

InitializeCriticalSection
ReleaseSemaphore
CreateSemaphoreW
ResetEvent
SetEvent
CreateEventW
SetThreadAffinityMask
ResumeThread
WaitForSingleObject
InterlockedIncrement
IsProcessorFeaturePresent
VirtualFree
VirtualAlloc
LoadLibraryW
FreeLibrary
QueryPerformanceCounter
GetOEMCP
FileTimeToLocalFileTime
DeleteCriticalSection
GetVersionExW
LocalFileTimeToFileTime
WaitForMultipleObjects
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
FileTimeToDosDateTime
DosDateTimeToFileTime
GlobalMemoryStatus
GetSystemInfo
GetCurrentProcess
GetProcessAffinityMask
CompareFileTime
GetLastError
MultiByteToWideChar
WideCharToMultiByte
CloseHandle
GetProcAddress
GetModuleHandleW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
GetModuleHandleA

Exports

Exports

CreateDecoder
CreateEncoder
CreateObject
GetHandlerProperty
GetHandlerProperty2
GetHashers
GetIsArc
GetMethodProperty
GetNumberOfFormats
GetNumberOfMethods
SetCaseSensitive
SetCodecs
SetLargePageMode

Sections

.text
Size: 878KB - Virtual size: 877KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 118KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/7z.exe
.exe windows:4 windows x86 arch:x86

8c1dd070b13c63abc19b1534fe4b4867

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

64:2c:f1:0a:f1:c6:ec:ad:2e:c5:51:61:b0:1f:15:33:1c:fc:2b:dd:b2:0a:5f:d3:f7:78:3b:e1:42:af:f7:55
Signer

Actual PE Digest

64:2c:f1:0a:f1:c6:ec:ad:2e:c5:51:61:b0:1f:15:33:1c:fc:2b:dd:b2:0a:5f:d3:f7:78:3b:e1:42:af:f7:55

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

oleaut32

SysStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
VariantCopy
VariantClear

user32

CharUpperW

advapi32

LookupPrivilegeValueW
GetFileSecurityW
SetFileSecurityW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
AdjustTokenPrivileges
OpenProcessToken

msvcrt

_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
exit
_XcptFilter
_exit
_onexit
__dllonexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler3
_beginthreadex
_ftol
memcmp
_purecall
memset
strlen
wcscmp
wcsstr
strcmp
memmove
fputs
fputc
fflush
fgetc
fclose
_iob
free
_CxxThrowException
malloc
memcpy
__CxxFrameHandler
_isatty
_fileno

kernel32

SetThreadAffinityMask
CreateEventW
SetEvent
InitializeCriticalSection
WaitForSingleObject
SetFileTime
VirtualFree
VirtualAlloc
SetConsoleMode
GetConsoleMode
GetVersionExW
SetFileApisToOEM
GetCommandLineW
GetConsoleScreenBufferInfo
SetConsoleCtrlHandler
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
GetProcessTimes
OpenEventW
OpenFileMappingW
MapViewOfFile
UnmapViewOfFile
SetProcessAffinityMask
GetStdHandle
GetSystemTimeAsFileTime
FileTimeToDosDateTime
IsProcessorFeaturePresent
GlobalMemoryStatus
GetSystemInfo
GetProcessAffinityMask
FileTimeToLocalFileTime
FileTimeToSystemTime
CompareFileTime
GetCurrentProcess
GetDiskFreeSpaceW
SetEndOfFile
WriteFile
ReadFile
DeviceIoControl
SetFilePointer
GetFileSize
GetLogicalDriveStringsW
GetLastError
MultiByteToWideChar
WideCharToMultiByte
FreeLibrary
LoadLibraryExW
LoadLibraryW
GetModuleFileNameW
LocalFree
FormatMessageW
CloseHandle
CreateFileW
SetFileAttributesW
RemoveDirectoryW
MoveFileW
GetProcAddress
GetModuleHandleW
CreateDirectoryW
DeleteFileW
SetLastError
SetCurrentDirectoryW
GetCurrentDirectoryW
GetTempPathW
GetCurrentProcessId
GetTickCount
GetCurrentThreadId
FindClose
FindFirstFileW
FindNextFileW
GetModuleHandleA
GetFileAttributesW
GetFileInformationByHandle
ResumeThread

Sections

.text
Size: 251KB - Virtual size: 251KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sxdata
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/AxWebServer.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Server\NSecsoft.Ping32.Server.AxWebServer\AxWebServer\WatsonWebserver\obj\Release\net452\AxWebServer.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 868B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/BouncyCastle.Crypto.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:d7:ef:74:a9:ff:03:a2:20:b6:ed:bb:39:9d:14:c1
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/03/2020, 00:00

Not After

23/03/2023, 12:00

Subject

SERIALNUMBER=5101633,CN=Claire Novotny LLC,O=Claire Novotny LLC,L=New York,ST=New York,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13084e657720596f726b,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

50:f9:9f:f6:b7:bb:0d:fd:f9:88:29:3c:59:b1:95:f7:d5:28:78:ff:4f:a5:9f:63:b3:ad:05:d2:27:cb:cf:a9
Signer

Actual PE Digest

50:f9:9f:f6:b7:bb:0d:fd:f9:88:29:3c:59:b1:95:f7:d5:28:78:ff:4f:a5:9f:63:b3:ad:05:d2:27:cb:cf:a9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

BouncyCastle.Crypto.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/CppScanFiles.exe
.exe windows:5 windows x86 arch:x86

1869dacfc289e6475689d06ed5f88574

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:05:55:97:ef:db:28:12:2d:3c:1d:54:b3:9b:66:1c:a5:4e:cb:eb:f7:75:d1:f6:b6:9a:ee:84:4e:e6:74:66
Signer

Actual PE Digest

46:05:55:97:ef:db:28:12:2d:3c:1d:54:b3:9b:66:1c:a5:4e:cb:eb:f7:75:d1:f6:b6:9a:ee:84:4e:e6:74:66

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
HeapCreate
ReadFile
AreFileApisANSI
GetCurrentThreadId
InitializeCriticalSection
EnterCriticalSection
WaitForSingleObject
TryEnterCriticalSection
DeleteCriticalSection
FindClose
GetModuleFileNameW
FindFirstFileW
FindNextFileW
GetFullPathNameW
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
WriteFile
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
GetFileAttributesA
CreateMutexW
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
LeaveCriticalSection
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
OpenProcess
LoadLibraryExW
GetModuleFileNameA
GetFileSizeEx
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
SetFilePointerEx
InterlockedDecrement
RaiseException
RtlUnwind
GetStdHandle
GetFileType
GetModuleHandleExW
WriteConsoleW
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
GetCommandLineA
GetCommandLineW
GetACP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExA

shlwapi

PathIsNetworkPathW
PathFindFileNameA
SHSetValueA
wvnsprintfA
wnsprintfA
wnsprintfW
PathAppendW
PathFindExtensionW

user32

wsprintfA

advapi32

GetTokenInformation
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExW
OpenProcessToken
RegCloseKey

shell32

SHCreateDirectoryExA

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoSetProxyBlanket

oleaut32

SysAllocString
SysFreeString

Sections

.text
Size: 785KB - Virtual size: 785KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 122KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.BonusSkins.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

56:6d:64:54:14:f9:0e:6d:1b:5e:c8:39:8c:9c:ea:21:15:34:70:b6:8d:b0:24:c3:8a:32:a0:4c:96:6a:db:05
Signer

Actual PE Digest

56:6d:64:54:14:f9:0e:6d:1b:5e:c8:39:8c:9c:ea:21:15:34:70:b6:8d:b0:24:c3:8a:32:a0:4c:96:6a:db:05

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\BonusSkins\obj_netFW\Release\DevExpress.BonusSkins.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 21.5MB - Virtual size: 21.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Charts.v22.1.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bf:fa:fb:42:6c:cf:74:6d:4d:2a:55:8a:05:85:5a:14:0d:11:cd:36:82:e1:6e:e9:31:d8:42:8c:c6:c2:0f:23
Signer

Actual PE Digest

bf:fa:fb:42:6c:cf:74:6d:4d:2a:55:8a:05:85:5a:14:0d:11:cd:36:82:e1:6e:e9:31:d8:42:8c:c6:c2:0f:23

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraCharts\DevExpress.Charts.Core\obj_netFW\Release\DevExpress.Charts.v22.1.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1014KB - Virtual size: 1013KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.CodeParser.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6c:a5:6b:81:40:58:34:da:7c:7d:40:1a:c7:60:75:93:30:6c:56:59:48:f7:f0:97:e4:c6:23:26:32:6f:06:3a
Signer

Actual PE Digest

6c:a5:6b:81:40:58:34:da:7c:7d:40:1a:c7:60:75:93:30:6c:56:59:48:f7:f0:97:e4:c6:23:26:32:6f:06:3a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.CodeParser\DevExpress.CodeParser\obj_netFW\Release\DevExpress.CodeParser.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Dashboard.v22.1.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ac:cd:c0:23:8b:6c:0e:c6:c1:41:7e:f2:18:30:42:60:d3:3d:e3:0b:0c:56:dc:3b:6d:38:32:80:f7:c8:a6:74
Signer

Actual PE Digest

ac:cd:c0:23:8b:6c:0e:c6:c1:41:7e:f2:18:30:42:60:d3:3d:e3:0b:0c:56:dc:3b:6d:38:32:80:f7:c8:a6:74

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Dashboard\DevExpress.Dashboard.Core\obj_netFW\Release\DevExpress.Dashboard.v22.1.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 7.7MB - Virtual size: 7.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Dashboard.v22.1.Win.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:b7:dc:79:85:d4:5a:28:60:ef:13:f8:fc:d6:1e:92:ad:82:d9:02:22:ea:39:31:27:1e:fa:0b:d2:c0:3d:b9
Signer

Actual PE Digest

0b:b7:dc:79:85:d4:5a:28:60:ef:13:f8:fc:d6:1e:92:ad:82:d9:02:22:ea:39:31:27:1e:fa:0b:d2:c0:3d:b9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Dashboard\DevExpress.Dashboard.Win\obj_netFW\Release\DevExpress.Dashboard.v22.1.Win.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 6.2MB - Virtual size: 6.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Data.Desktop.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:c3:c1:36:2e:2b:e8:62:46:3c:cc:b7:f5:75:f6:50:75:ed:04:db:ce:40:df:0d:c8:ec:a3:78:86:ad:b0:81
Signer

Actual PE Digest

01:c3:c1:36:2e:2b:e8:62:46:3c:cc:b7:f5:75:f6:50:75:ed:04:db:ce:40:df:0d:c8:ec:a3:78:86:ad:b0:81

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Data.Desktop\DevExpress.Data.Desktop\obj_netFW\Release\DevExpress.Data.Desktop.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 836KB - Virtual size: 835KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Data.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5a:46:f7:4c:a8:ce:ca:59:91:1f:bb:34:92:a6:de:f2:76:4f:60:a4:a9:e7:f4:fd:6b:82:17:1f:f4:b8:b1:44
Signer

Actual PE Digest

5a:46:f7:4c:a8:ce:ca:59:91:1f:bb:34:92:a6:de:f2:76:4f:60:a4:a9:e7:f4:fd:6b:82:17:1f:f4:b8:b1:44

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Data\DevExpress.Data\obj_netFW\Release\DevExpress.Data.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.DataAccess.v22.1.UI.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

10:d6:1a:96:e0:b2:df:00:5e:90:78:9e:99:eb:4c:8c:24:b0:9b:b5:de:28:e2:16:21:69:a3:78:76:89:c5:d8
Signer

Actual PE Digest

10:d6:1a:96:e0:b2:df:00:5e:90:78:9e:99:eb:4c:8c:24:b0:9b:b5:de:28:e2:16:21:69:a3:78:76:89:c5:d8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.DataAccess\DevExpress.DataAccess.UI\obj_netFW\Release\DevExpress.DataAccess.v22.1.UI.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.DataAccess.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f2:92:c8:df:36:9d:ac:9f:db:d3:c4:71:9d:87:07:bd:26:80:57:8f:61:76:81:40:ec:57:44:b5:e1:68:81:72
Signer

Actual PE Digest

f2:92:c8:df:36:9d:ac:9f:db:d3:c4:71:9d:87:07:bd:26:80:57:8f:61:76:81:40:ec:57:44:b5:e1:68:81:72

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.DataAccess\DevExpress.DataAccess\obj_netFW\Release\DevExpress.DataAccess.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.DataVisualization.v22.1.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5d:91:35:00:c6:19:d1:2a:22:68:6f:1d:6a:c0:8c:2e:d0:72:47:ea:97:f6:1e:85:94:22:86:3d:ee:b6:1b:ed
Signer

Actual PE Digest

5d:91:35:00:c6:19:d1:2a:22:68:6f:1d:6a:c0:8c:2e:d0:72:47:ea:97:f6:1e:85:94:22:86:3d:ee:b6:1b:ed

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Win\DevExpress.XtraCharts\DevExpress.DataVisualization.Core\obj_netFW\Release\DevExpress.DataVisualization.v22.1.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Diagram.v22.1.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1f:99:b1:73:1d:ad:b1:c6:0c:0a:49:52:91:e2:29:97:c0:eb:0d:ad:76:91:5a:77:6e:32:de:d9:df:66:29:1d
Signer

Actual PE Digest

1f:99:b1:73:1d:ad:b1:c6:0c:0a:49:52:91:e2:29:97:c0:eb:0d:ad:76:91:5a:77:6e:32:de:d9:df:66:29:1d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraDiagram\DevExpress.Diagram.Core\obj_netFW\Release\DevExpress.Diagram.v22.1.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Dialogs.v22.1.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f8:f6:41:61:33:43:74:26:52:a0:36:dd:40:cd:84:cb:ee:bc:ba:cd:b2:ff:37:f4:4e:b6:d7:5d:7b:b8:d3:5c
Signer

Actual PE Digest

f8:f6:41:61:33:43:74:26:52:a0:36:dd:40:cd:84:cb:ee:bc:ba:cd:b2:ff:37:f4:4e:b6:d7:5d:7b:b8:d3:5c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraDialogs\DevExpress.Dialogs.Core\obj_netFW\Release\DevExpress.Dialogs.v22.1.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 914KB - Virtual size: 914KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Docs.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:a4:3d:0d:d2:0a:92:7e:9d:65:c3:5a:96:c0:b5:8a:d5:cd:27:07:ab:59:14:db:1a:9f:9e:5a:c0:9b:70:a1
Signer

Actual PE Digest

0b:a4:3d:0d:d2:0a:92:7e:9d:65:c3:5a:96:c0:b5:8a:d5:cd:27:07:ab:59:14:db:1a:9f:9e:5a:c0:9b:70:a1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Docs\DevExpress.Docs\obj_netFW\Release\DevExpress.Docs.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 442KB - Virtual size: 442KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Drawing.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ad:43:b2:f1:ee:f8:05:b4:b5:e2:33:38:cc:79:f5:af:47:8d:97:fc:19:a3:1e:7e:88:87:10:1f:59:8d:f4:51
Signer

Actual PE Digest

ad:43:b2:f1:ee:f8:05:b4:b5:e2:33:38:cc:79:f5:af:47:8d:97:fc:19:a3:1e:7e:88:87:10:1f:59:8d:f4:51

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Drawing\DevExpress.Drawing\obj_netFW\Release\DevExpress.Drawing.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 289KB - Virtual size: 288KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Images.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

93:85:3a:00:dc:eb:b8:8b:b8:10:8f:d1:9f:71:96:43:3d:58:ff:be:43:59:f0:83:11:19:12:d7:d9:47:f3:78
Signer

Actual PE Digest

93:85:3a:00:dc:eb:b8:8b:b8:10:8f:d1:9f:71:96:43:3d:58:ff:be:43:59:f0:83:11:19:12:d7:d9:47:f3:78

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Images\DevExpress.Images\obj_netFW\Release\DevExpress.Images.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 8.4MB - Virtual size: 8.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Map.v22.1.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ae:de:6d:58:38:66:a3:71:06:29:b9:60:30:7a:f5:3d:c4:71:bd:20:82:89:6f:66:b6:39:ce:4e:60:21:fa:bc
Signer

Actual PE Digest

ae:de:6d:58:38:66:a3:71:06:29:b9:60:30:7a:f5:3d:c4:71:bd:20:82:89:6f:66:b6:39:ce:4e:60:21:fa:bc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraMap\DevExpress.Map.Core\obj_netFW\Release\DevExpress.Map.v22.1.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Office.v22.1.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:ec:11:81:92:3e:d8:ab:30:17:57:f7:0f:98:f4:d8:fb:de:95:25:43:11:98:eb:d0:17:5f:04:1d:35:09:78
Signer

Actual PE Digest

07:ec:11:81:92:3e:d8:ab:30:17:57:f7:0f:98:f4:d8:fb:de:95:25:43:11:98:eb:d0:17:5f:04:1d:35:09:78

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Office\DevExpress.Office.Core\obj_netFW\Release\DevExpress.Office.v22.1.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3.7MB - Virtual size: 3.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Pdf.v22.1.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3b:d2:e0:4e:d5:eb:aa:0b:b4:33:62:ec:9b:dc:f5:e4:1e:ee:5d:ad:47:4e:19:6b:36:f4:8c:1e:24:ab:7a:a8
Signer

Actual PE Digest

3b:d2:e0:4e:d5:eb:aa:0b:b4:33:62:ec:9b:dc:f5:e4:1e:ee:5d:ad:47:4e:19:6b:36:f4:8c:1e:24:ab:7a:a8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Pdf\DevExpress.Pdf.Core\obj_netFW\Release\DevExpress.Pdf.v22.1.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 5.0MB - Virtual size: 5.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Pdf.v22.1.Drawing.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

31:7e:9b:b3:15:3e:91:59:1e:2b:18:38:21:cd:7c:4a:fd:d0:6a:f0:57:6a:e8:70:ef:ad:67:fe:88:0e:95:17
Signer

Actual PE Digest

31:7e:9b:b3:15:3e:91:59:1e:2b:18:38:21:cd:7c:4a:fd:d0:6a:f0:57:6a:e8:70:ef:ad:67:fe:88:0e:95:17

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Pdf\DevExpress.Pdf.Drawing\obj_netFW\Release\DevExpress.Pdf.v22.1.Drawing.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 491KB - Virtual size: 490KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.PivotGrid.v22.1.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

87:a7:24:e7:c5:c9:d7:50:6f:31:6d:d0:60:04:be:33:07:eb:b8:a2:a2:50:ce:57:21:19:b1:e8:01:e6:4e:20
Signer

Actual PE Digest

87:a7:24:e7:c5:c9:d7:50:6f:31:6d:d0:60:04:be:33:07:eb:b8:a2:a2:50:ce:57:21:19:b1:e8:01:e6:4e:20

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraPivotGrid\DevExpress.XtraPivotGrid.Core\obj_netFW\Release\DevExpress.PivotGrid.v22.1.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Printing.v22.1.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fb:65:8e:f3:04:08:11:78:87:f7:0b:4a:be:94:7d:ab:5e:cd:80:2f:ba:06:0b:1b:17:64:a1:a5:a2:2d:48:da
Signer

Actual PE Digest

fb:65:8e:f3:04:08:11:78:87:f7:0b:4a:be:94:7d:ab:5e:cd:80:2f:ba:06:0b:1b:17:64:a1:a5:a2:2d:48:da

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraPrinting\DevExpress.Printing.Core\obj_netFW\Release\DevExpress.Printing.v22.1.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4.5MB - Virtual size: 4.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.RichEdit.v22.1.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

56:60:f0:ea:bb:fb:b5:d3:94:d4:76:80:c0:bd:42:27:7b:4a:68:90:41:1c:f7:12:62:07:ef:0f:55:20:b7:08
Signer

Actual PE Digest

56:60:f0:ea:bb:fb:b5:d3:94:d4:76:80:c0:bd:42:27:7b:4a:68:90:41:1c:f7:12:62:07:ef:0f:55:20:b7:08

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraRichEdit\DevExpress.RichEdit.Core\obj_netFW\Release\DevExpress.RichEdit.v22.1.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 8.4MB - Virtual size: 8.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Snap.v22.1.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f7:dc:15:1e:90:d7:54:e2:96:73:b2:11:10:49:a3:7a:a3:09:70:d2:87:36:22:25:c7:9c:b7:3a:8e:ad:67:9c
Signer

Actual PE Digest

f7:dc:15:1e:90:d7:54:e2:96:73:b2:11:10:49:a3:7a:a3:09:70:d2:87:36:22:25:c7:9c:b7:3a:8e:ad:67:9c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Snap\DevExpress.Snap.Core\obj_netFW\Release\DevExpress.Snap.v22.1.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 922KB - Virtual size: 921KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Sparkline.v22.1.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f7:ca:9b:92:57:c7:0e:cf:a0:76:ae:5d:dc:da:4b:ea:ba:01:c8:44:3e:7c:e0:2d:11:2d:c0:36:fb:11:77:f8
Signer

Actual PE Digest

f7:ca:9b:92:57:c7:0e:cf:a0:76:ae:5d:dc:da:4b:ea:ba:01:c8:44:3e:7c:e0:2d:11:2d:c0:36:fb:11:77:f8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraCharts\DevExpress.Sparkline.Core\obj_netFW\Release\DevExpress.Sparkline.v22.1.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 76KB - Virtual size: 76KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Spreadsheet.v22.1.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:cc:0a:16:dd:33:30:cc:61:bf:23:e1:d8:a7:9d:de:03:41:ba:7f:c5:b3:a5:67:48:ab:22:de:a6:4e:7e:1f
Signer

Actual PE Digest

09:cc:0a:16:dd:33:30:cc:61:bf:23:e1:d8:a7:9d:de:03:41:ba:7f:c5:b3:a5:67:48:ab:22:de:a6:4e:7e:1f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraSpreadsheet\DevExpress.Spreadsheet.Core\obj_netFW\Release\DevExpress.Spreadsheet.v22.1.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 16.5MB - Virtual size: 16.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.TreeMap.v22.1.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3f:fb:54:1c:e9:3b:c9:02:d9:c1:fe:56:fc:0b:25:c3:8f:5d:36:c2:fc:54:92:3e:ac:93:78:43:5b:81:e2:c5
Signer

Actual PE Digest

3f:fb:54:1c:e9:3b:c9:02:d9:c1:fe:56:fc:0b:25:c3:8f:5d:36:c2:fc:54:92:3e:ac:93:78:43:5b:81:e2:c5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraTreeMap\DevExpress.TreeMap.Core\obj_netFW\Release\DevExpress.TreeMap.v22.1.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Utils.v22.1.UI.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b9:a3:17:fa:ca:90:6b:76:c9:e7:22:57:fe:20:ea:ca:89:d6:94:bd:18:d8:bb:f3:57:c5:b0:cb:7f:d0:a5:99
Signer

Actual PE Digest

b9:a3:17:fa:ca:90:6b:76:c9:e7:22:57:fe:20:ea:ca:89:d6:94:bd:18:d8:bb:f3:57:c5:b0:cb:7f:d0:a5:99

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Utils.UI\DevExpress.Utils.UI\obj_netFW\Release\DevExpress.Utils.v22.1.UI.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 362KB - Virtual size: 362KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Utils.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9c:96:91:29:ac:38:51:fb:4b:07:a0:13:b0:fb:78:21:8b:4f:dc:5c:2c:73:67:64:a9:ed:9e:c9:26:50:32:4e
Signer

Actual PE Digest

9c:96:91:29:ac:38:51:fb:4b:07:a0:13:b0:fb:78:21:8b:4f:dc:5c:2c:73:67:64:a9:ed:9e:c9:26:50:32:4e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Utils\DevExpress.Utils\obj_netFW\Release\DevExpress.Utils.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 20.0MB - Virtual size: 20.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.Xpo.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9c:87:2d:e1:35:b2:d9:69:b6:4d:c0:02:5b:ca:82:a8:cf:cf:f9:a5:5a:b3:3c:fe:7e:84:60:5f:eb:24:77:bf
Signer

Actual PE Digest

9c:87:2d:e1:35:b2:d9:69:b6:4d:c0:02:5b:ca:82:a8:cf:cf:f9:a5:5a:b3:3c:fe:7e:84:60:5f:eb:24:77:bf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Xpo\DevExpress.Xpo\obj_netFW\Release\DevExpress.Xpo.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2.2MB - Virtual size: 2.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraBars.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

58:ca:e9:57:22:5c:5e:ca:70:c3:de:5d:ec:c7:0d:66:71:dd:2d:65:d0:a4:6c:76:ca:05:74:2b:7e:7e:87:b0
Signer

Actual PE Digest

58:ca:e9:57:22:5c:5e:ca:70:c3:de:5d:ec:c7:0d:66:71:dd:2d:65:d0:a4:6c:76:ca:05:74:2b:7e:7e:87:b0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraBars\DevExpress.XtraBars\obj_netFW\Release\DevExpress.XtraBars.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 6.5MB - Virtual size: 6.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraCharts.v22.1.UI.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

80:af:e4:73:ce:ab:05:7f:25:a0:35:52:5e:1e:4e:3b:f5:e6:6e:b0:d9:c9:89:8b:97:50:7b:e2:ac:97:6d:50
Signer

Actual PE Digest

80:af:e4:73:ce:ab:05:7f:25:a0:35:52:5e:1e:4e:3b:f5:e6:6e:b0:d9:c9:89:8b:97:50:7b:e2:ac:97:6d:50

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraCharts\DevExpress.XtraCharts.UI\obj_netFW\Release\DevExpress.XtraCharts.v22.1.UI.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 524KB - Virtual size: 523KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraCharts.v22.1.Wizard.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bf:52:ca:84:ff:9d:1c:25:02:63:3d:1c:22:fd:2e:59:92:19:13:ad:c4:de:b9:11:c2:9e:c9:fc:d1:4d:3b:bc
Signer

Actual PE Digest

bf:52:ca:84:ff:9d:1c:25:02:63:3d:1c:22:fd:2e:59:92:19:13:ad:c4:de:b9:11:c2:9e:c9:fc:d1:4d:3b:bc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraCharts\DevExpress.XtraCharts.Wizard\obj_netFW\Release\DevExpress.XtraCharts.v22.1.Wizard.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 8.3MB - Virtual size: 8.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraCharts.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3e:13:ba:56:7f:6d:8b:69:08:0b:4e:28:70:0c:57:3b:b3:97:86:66:a3:a1:56:44:8e:83:71:50:4d:e9:c2:69
Signer

Actual PE Digest

3e:13:ba:56:7f:6d:8b:69:08:0b:4e:28:70:0c:57:3b:b3:97:86:66:a3:a1:56:44:8e:83:71:50:4d:e9:c2:69

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraCharts\DevExpress.XtraCharts\obj_netFW\Release\DevExpress.XtraCharts.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4.9MB - Virtual size: 4.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraDiagram.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b4:d6:fe:f5:13:fe:87:f4:08:67:38:ba:ce:ce:1c:8c:16:6b:5e:d4:11:1b:a7:25:de:3e:eb:74:e0:99:e9:ed
Signer

Actual PE Digest

b4:d6:fe:f5:13:fe:87:f4:08:67:38:ba:ce:ce:1c:8c:16:6b:5e:d4:11:1b:a7:25:de:3e:eb:74:e0:99:e9:ed

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraDiagram\DevExpress.XtraDiagram\obj_netFW\Release\DevExpress.XtraDiagram.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraDialogs.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

87:99:d1:7b:2c:19:eb:fd:39:62:66:e5:a8:20:4e:60:13:9d:3c:ad:56:59:4e:2f:5c:38:80:2b:c8:f2:e2:52
Signer

Actual PE Digest

87:99:d1:7b:2c:19:eb:fd:39:62:66:e5:a8:20:4e:60:13:9d:3c:ad:56:59:4e:2f:5c:38:80:2b:c8:f2:e2:52

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraDialogs\DevExpress.XtraDialogs\obj_netFW\Release\DevExpress.XtraDialogs.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 888KB - Virtual size: 887KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraEditors.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

57:e5:d5:c9:9e:5e:68:68:34:ab:dd:7b:ad:55:51:21:22:3a:69:fa:ce:ed:12:fd:37:db:69:12:05:cc:47:64
Signer

Actual PE Digest

57:e5:d5:c9:9e:5e:68:68:34:ab:dd:7b:ad:55:51:21:22:3a:69:fa:ce:ed:12:fd:37:db:69:12:05:cc:47:64

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraEditors\DevExpress.XtraEditors\obj_netFW\Release\DevExpress.XtraEditors.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 7.7MB - Virtual size: 7.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraGauges.v22.1.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

53:22:63:08:dd:33:e9:eb:3c:4f:78:76:58:be:1d:ad:6c:7e:7f:c6:b2:d2:f9:7e:08:49:1c:7f:7b:a5:9a:a6
Signer

Actual PE Digest

53:22:63:08:dd:33:e9:eb:3c:4f:78:76:58:be:1d:ad:6c:7e:7f:c6:b2:d2:f9:7e:08:49:1c:7f:7b:a5:9a:a6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraGauges\DevExpress.XtraGauges.Core\obj_netFW\Release\DevExpress.XtraGauges.v22.1.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraGauges.v22.1.Presets.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3f:47:cb:7d:a4:4b:3c:94:7f:5a:1d:3a:7f:a0:a6:d1:7c:e6:57:ed:12:9a:50:c5:5d:a7:c4:89:74:9f:5e:c9
Signer

Actual PE Digest

3f:47:cb:7d:a4:4b:3c:94:7f:5a:1d:3a:7f:a0:a6:d1:7c:e6:57:ed:12:9a:50:c5:5d:a7:c4:89:74:9f:5e:c9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraGauges\DevExpress.XtraGauges.Presets\obj_netFW\Release\DevExpress.XtraGauges.v22.1.Presets.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraGauges.v22.1.Win.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:7e:9a:37:1d:f1:e1:0f:cf:d9:60:c4:75:d6:fa:93:42:7d:55:c6:1c:eb:51:a0:61:57:b7:3b:f8:54:e0:94
Signer

Actual PE Digest

0a:7e:9a:37:1d:f1:e1:0f:cf:d9:60:c4:75:d6:fa:93:42:7d:55:c6:1c:eb:51:a0:61:57:b7:3b:f8:54:e0:94

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraGauges\DevExpress.XtraGauges.Win\obj_netFW\Release\DevExpress.XtraGauges.v22.1.Win.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 249KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraGrid.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

51:ef:47:2e:3c:36:b8:fb:91:44:51:7b:43:15:23:27:98:62:84:13:d1:19:d1:23:dc:b2:3d:38:ca:b6:1a:1f
Signer

Actual PE Digest

51:ef:47:2e:3c:36:b8:fb:91:44:51:7b:43:15:23:27:98:62:84:13:d1:19:d1:23:dc:b2:3d:38:ca:b6:1a:1f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraGrid\DevExpress.XtraGrid\obj_netFW\Release\DevExpress.XtraGrid.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraLayout.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9f:64:6d:36:ac:e1:24:3f:49:c3:ad:75:fc:8e:5d:9d:29:82:f4:fb:3c:f4:2b:2f:27:b0:8b:9b:e2:af:9f:dd
Signer

Actual PE Digest

9f:64:6d:36:ac:e1:24:3f:49:c3:ad:75:fc:8e:5d:9d:29:82:f4:fb:3c:f4:2b:2f:27:b0:8b:9b:e2:af:9f:dd

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraLayout\DevExpress.XtraLayout\obj_netFW\Release\DevExpress.XtraLayout.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraMap.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

34:24:98:b1:03:bf:81:06:d0:d5:d3:8e:f2:7d:34:cf:3a:63:46:06:94:53:6a:d6:e8:73:b9:fc:60:4c:10:15
Signer

Actual PE Digest

34:24:98:b1:03:bf:81:06:d0:d5:d3:8e:f2:7d:34:cf:3a:63:46:06:94:53:6a:d6:e8:73:b9:fc:60:4c:10:15

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraMap\DevExpress.XtraMap\obj_netFW\Release\DevExpress.XtraMap.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraNavBar.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4b:a5:cd:74:d7:6b:2b:06:38:5e:a1:7d:8d:82:6b:d5:da:94:9c:a2:da:82:75:b6:dd:66:18:65:5c:b4:ca:63
Signer

Actual PE Digest

4b:a5:cd:74:d7:6b:2b:06:38:5e:a1:7d:8d:82:6b:d5:da:94:9c:a2:da:82:75:b6:dd:66:18:65:5c:b4:ca:63

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraNavBar\DevExpress.XtraNavBar\obj_netFW\Release\DevExpress.XtraNavBar.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 421KB - Virtual size: 420KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraPdfViewer.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a8:70:02:08:65:97:39:e7:35:89:ab:d0:77:00:4c:90:15:f6:b2:04:5b:a7:87:dc:2b:f9:95:4e:c0:49:0d:8f
Signer

Actual PE Digest

a8:70:02:08:65:97:39:e7:35:89:ab:d0:77:00:4c:90:15:f6:b2:04:5b:a7:87:dc:2b:f9:95:4e:c0:49:0d:8f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.Pdf\DevExpress.XtraPdfViewer\obj_netFW\Release\DevExpress.XtraPdfViewer.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraPivotGrid.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f8:bf:e3:d6:4c:f1:ef:77:69:80:65:ec:0d:7c:47:6e:6e:96:b9:d9:5f:ac:40:c7:ca:e5:c2:df:57:bd:5b:cf
Signer

Actual PE Digest

f8:bf:e3:d6:4c:f1:ef:77:69:80:65:ec:0d:7c:47:6e:6e:96:b9:d9:5f:ac:40:c7:ca:e5:c2:df:57:bd:5b:cf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraPivotGrid\DevExpress.XtraPivotGrid\obj_netFW\Release\DevExpress.XtraPivotGrid.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 886KB - Virtual size: 886KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraPrinting.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

dd:4c:8c:bb:42:a0:0b:4e:fe:dd:e3:d0:16:6d:de:26:6a:05:5b:5d:ba:36:0a:f2:5f:d2:15:47:0f:76:42:64
Signer

Actual PE Digest

dd:4c:8c:bb:42:a0:0b:4e:fe:dd:e3:d0:16:6d:de:26:6a:05:5b:5d:ba:36:0a:f2:5f:d2:15:47:0f:76:42:64

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraPrinting\DevExpress.XtraPrinting\obj_netFW\Release\DevExpress.XtraPrinting.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraReports.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:14:25:97:45:16:fa:95:0d:b6:c2:b2:33:d2:01:79:f8:1f:f4:fc:d7:29:57:4f:f9:6d:08:b5:aa:e0:93:58
Signer

Actual PE Digest

6f:14:25:97:45:16:fa:95:0d:b6:c2:b2:33:d2:01:79:f8:1f:f4:fc:d7:29:57:4f:f9:6d:08:b5:aa:e0:93:58

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraReports\DevExpress.XtraReports\obj_netFW\Release\DevExpress.XtraReports.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraRichEdit.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b5:28:a9:f8:eb:06:9b:9f:ed:98:d0:f6:48:d8:64:02:a0:a6:e3:b7:7e:29:8a:9e:ca:66:90:13:8e:c3:29:ee
Signer

Actual PE Digest

b5:28:a9:f8:eb:06:9b:9f:ed:98:d0:f6:48:d8:64:02:a0:a6:e3:b7:7e:29:8a:9e:ca:66:90:13:8e:c3:29:ee

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraRichEdit\DevExpress.XtraRichEdit\obj_netFW\Release\DevExpress.XtraRichEdit.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraSpreadsheet.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:79:50:19:30:bc:90:d6:9f:3e:8c:9a:a9:b4:85:95:09:76:f3:1e:a1:ba:49:d1:e5:2a:18:2a:dd:0e:c8:21
Signer

Actual PE Digest

3a:79:50:19:30:bc:90:d6:9f:3e:8c:9a:a9:b4:85:95:09:76:f3:1e:a1:ba:49:d1:e5:2a:18:2a:dd:0e:c8:21

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraSpreadsheet\DevExpress.XtraSpreadsheet\obj_netFW\Release\DevExpress.XtraSpreadsheet.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraTreeList.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

79:27:da:fc:a3:52:8f:21:9f:91:66:8d:c0:6e:29:75:b1:68:85:5e:7a:e1:c0:4b:b7:45:5a:30:37:5b:3e:6c
Signer

Actual PE Digest

79:27:da:fc:a3:52:8f:21:9f:91:66:8d:c0:6e:29:75:b1:68:85:5e:7a:e1:c0:4b:b7:45:5a:30:37:5b:3e:6c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraTreeList\DevExpress.XtraTreeList\obj_netFW\Release\DevExpress.XtraTreeList.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraTreeMap.v22.1.UI.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d3:71:87:87:42:17:f2:15:98:dd:d3:15:1c:46:6d:e0:30:c0:42:6a:fa:8f:c5:72:a1:c8:2f:b6:ed:a4:94:6d
Signer

Actual PE Digest

d3:71:87:87:42:17:f2:15:98:dd:d3:15:1c:46:6d:e0:30:c0:42:6a:fa:8f:c5:72:a1:c8:2f:b6:ed:a4:94:6d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

Win\DevExpress.XtraTreeMap\DevExpress.XtraTreeMap.UI\obj_netFW\Release\DevExpress.XtraTreeMap.v22.1.UI.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraTreeMap.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ee:89:84:35:71:94:b2:5d:e8:b7:47:e1:95:fa:05:67:63:0c:10:22:fa:0b:d9:35:6e:36:2f:8c:27:45:f3:a9
Signer

Actual PE Digest

ee:89:84:35:71:94:b2:5d:e8:b7:47:e1:95:fa:05:67:63:0c:10:22:fa:0b:d9:35:6e:36:2f:8c:27:45:f3:a9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraTreeMap\DevExpress.XtraTreeMap\obj_netFW\Release\DevExpress.XtraTreeMap.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 269KB - Virtual size: 269KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraVerticalGrid.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9f:ef:ca:f4:6d:54:55:41:5d:40:db:83:9d:a5:1b:8b:65:a8:33:e9:9e:7d:d6:c6:d7:95:3f:f0:b9:1e:90:9b
Signer

Actual PE Digest

9f:ef:ca:f4:6d:54:55:41:5d:40:db:83:9d:a5:1b:8b:65:a8:33:e9:9e:7d:d6:c6:d7:95:3f:f0:b9:1e:90:9b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraVerticalGrid\DevExpress.XtraVerticalGrid\obj_netFW\Release\DevExpress.XtraVerticalGrid.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DevExpress.XtraWizard.v22.1.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

47:2c:be:08:69:1c:d7:38:13:a5:1d:d6:45:38:76:d3
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

15/01/2020, 00:00

Not After

20/01/2023, 23:59

Subject

CN=Developer Express Incorporated,O=Developer Express Incorporated,L=Glendale,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:24:0a:fb:1e:38:0b:8a:16:f1:4b:71:9d:f4:d3:c0
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09/06/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6b:a5:96:98:97:9e:1d:af:c2:2a:38:62:00:8a:bc:41:90:7d:08:39:5a:c2:30:58:18:b1:74:93:23:d7:65:82
Signer

Actual PE Digest

6b:a5:96:98:97:9e:1d:af:c2:2a:38:62:00:8a:bc:41:90:7d:08:39:5a:c2:30:58:18:b1:74:93:23:d7:65:82

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\projects\22.1\BuildLabel\Temp\NetStudio.v22.1.2005\Win\DevExpress.XtraWizard\DevExpress.XtraWizard\obj_netFW\Release\DevExpress.XtraWizard.v22.1.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/DocumentFormat.OpenXml.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:01:df:6b:f0:2e:92:a7:4a:b4:d0:00:00:00:00:01:df
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/12/2020, 21:31

Not After

02/12/2021, 21:31

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

76:3b:a1:4e:6d:9f:1d:01:a6:f9:1c:9b:f1:6c:33:b3:b3:3f:39:cd:78:68:2b:87:ee:69:1a:12:ba:02:87:f2
Signer

Actual PE Digest

76:3b:a1:4e:6d:9f:1d:01:a6:f9:1c:9b:f1:6c:33:b3:b3:3f:39:cd:78:68:2b:87:ee:69:1a:12:ba:02:87:f2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/obj/DocumentFormat.OpenXml/Release/net40/DocumentFormat.OpenXml.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 5.6MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/ICSharpCode.SharpZipLib.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/src/ICSharpCode.SharpZipLib/obj/Release/net45/ICSharpCode.SharpZipLib.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 197KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/JsonFx.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 211KB - Virtual size: 211KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/MailKit.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\src\MailKit\MailKit\obj\Release\net45\MailKit.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 808KB - Virtual size: 807KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/Microsoft.CSharp.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ee:9f:62:b2:98:ff:50:47:a2:9a:74:c2:b7:83:15:1c:97:3d:ac:44:c8:a5:5d:52:e0:99:b7:a1:e8:df:13:ed
Signer

Actual PE Digest

ee:9f:62:b2:98:ff:50:47:a2:9a:74:c2:b7:83:15:1c:97:3d:ac:44:c8:a5:5d:52:e0:99:b7:a1:e8:df:13:ed

Digest Algorithm

sha256

PE Digest Matches

true

29:a5:7a:df:d3:86:9b:70:9f:33:89:91:c9:28:d8:68:9e:ec:e0:e5
Signer

Actual PE Digest

29:a5:7a:df:d3:86:9b:70:9f:33:89:91:c9:28:d8:68:9e:ec:e0:e5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/Microsoft.IO.RecyclableMemoryStream.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:12:55:de:2e:28:6b:e0:f5:02:17:e4:51:ac:b0:55:e7:66:00:71:7b:6d:be:a7:7f:f2:09:97:52:f1:6e:fe
Signer

Actual PE Digest

4c:12:55:de:2e:28:6b:e0:f5:02:17:e4:51:ac:b0:55:e7:66:00:71:7b:6d:be:a7:7f:f2:09:97:52:f1:6e:fe

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\1\s\src\obj\Release\net45\Microsoft.IO.RecyclableMemoryStream.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/MimeKit.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\src\MimeKit\MimeKit\obj\Release\net45\MimeKit.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 995KB - Virtual size: 995KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/MsgReader.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\tfs\MSGReader\MsgReaderCore\obj\Release\net45\MsgReader.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 385KB - Virtual size: 385KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/NSDesPack.dll
.dll windows:5 windows x86 arch:x86

c9905350490a5fdb54e1fcd29b49f7bc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\NSDesPack.pdb

Imports

kernel32

SystemTimeToFileTime
FileTimeToLocalFileTime
FileTimeToSystemTime
GetLastError
GetProcAddress
MoveFileExW
DeleteFileW
LoadLibraryW
SetFileAttributesW
GetSystemDirectoryW
GetFileAttributesW
CreateFileW
GetCurrentProcessId
GetModuleHandleW
CopyFileW
GetFileTime
GetExitCodeProcess
DisableThreadLibraryCalls
GetLocalTime
GetTickCount
ResetEvent
GetProcessId
GetCurrentDirectoryW
SystemTimeToTzSpecificLocalTime
CloseHandle
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
WaitForSingleObject
GetTempPathW
GetModuleFileNameW
WriteFile
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
QueryPerformanceFrequency
SleepEx
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
lstrlenW
CreateDirectoryW
GetConsoleCP
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
FormatMessageW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
ReadFile
QueryDosDeviceW
GetLogicalDrives
FindFirstFileW
HeapFree
FindNextFileW
DeviceIoControl
RemoveDirectoryW
GetDriveTypeA
SetFilePointer
SetEndOfFile
FindClose
GetVolumeInformationA
GetVersionExW
UnmapViewOfFile
GetModuleHandleA
OpenProcess
GetFileAttributesExW
CreateFileA
DeleteFileA
HeapAlloc
LocalFree
GetProcessHeap
CreateProcessW
FreeLibrary
CreateFileMappingW
MapViewOfFile
LoadLibraryExW
GetFileSize
GetModuleFileNameA
GetFileSizeEx
OutputDebugStringA
GetSystemDirectoryA
SetFileAttributesA
SetFilePointerEx
VirtualFree
VirtualAlloc
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
OpenEventW
SetEvent
WritePrivateProfileStringA
GetComputerNameW
CreateDirectoryA
GetPrivateProfileStringA
InterlockedDecrement
HeapSize
HeapReAlloc
RaiseException
HeapDestroy
InitializeCriticalSection
OpenFileMappingW
CreateMutexW
ReleaseMutex
OpenMutexW
Sleep
GetDriveTypeW
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
GetSystemTime
FormatMessageA
FlushFileBuffers
SetWaitableTimer
CreateWaitableTimerW
LocalFileTimeToFileTime
QueueUserAPC
GetFileAttributesExA
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetStdHandle
GetFileType
GetModuleHandleExW
WriteConsoleW
ExitProcess
CreateThread
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
GetACP
GetDateFormatW
GetTimeFormatW

user32

GetSystemMetrics
EnumDisplayMonitors
GetWindowLongW
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
GetMessageW
DefWindowProcW
CreateWindowExW
SendMessageW
ShowWindow
DispatchMessageW
RegisterClassW
TranslateMessage
LoadIconW
LoadCursorW
SetWindowLongW
SetThreadDesktop
GetThreadDesktop
CloseDesktop
UpdateLayeredWindow
OpenInputDesktop
PostQuitMessage
UpdateWindow
FindWindowW
PostMessageW
SetForegroundWindow
GetWindowRect
GetDC
ReleaseDC
wsprintfW
wsprintfA
GetWindowThreadProcessId
IsWindow
GetMonitorInfoW
AttachThreadInput
GetForegroundWindow
SetWindowPos

advapi32

AllocateAndInitializeSid
RegQueryValueExA
CloseServiceHandle
GetTokenInformation
LookupAccountNameW
ConvertSidToStringSidW
RegOpenKeyExA
InitializeSecurityDescriptor
OpenProcessToken
ConvertStringSidToSidW
SetNamedSecurityInfoW
RegCreateKeyExW
ConvertSidToStringSidA
RegSetValueW
RegQueryValueExW
GetUserNameW
OpenServiceW
RegCreateKeyW
RegOpenKeyExW
RegSetValueExW
OpenSCManagerW
QueryServiceStatus
RegCloseKey
SetFileSecurityW
SetEntriesInAclW
SetSecurityDescriptorDacl
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ConvertStringSecurityDescriptorToSecurityDescriptorW

shell32

SHCreateDirectoryExA
ShellExecuteExW
SHCreateDirectoryExW
SHGetSpecialFolderPathW

ws2_32

connect
socket
WSASetLastError
WSACloseEvent
closesocket
WSAIoctl
bind
gethostname
getsockname
send
WSAResetEvent
getpeername
getsockopt
ntohs
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
freeaddrinfo
htons
setsockopt
WSAGetLastError
recvfrom
WSAWaitForMultipleEvents
inet_ntoa
WSAEventSelect
inet_addr
WSAStartup
WSASocketW
WSACreateEvent
gethostbyname
WSACleanup
sendto
recv
ioctlsocket
getnameinfo
shutdown
WSAEnumNetworkEvents

shlwapi

SHSetValueA
PathFindFileNameA
SHSetValueW
wvnsprintfA
wvnsprintfW
SHDeleteValueW
PathAppendW
wnsprintfW
PathAddExtensionW
PathFileExistsW
PathRemoveExtensionW
PathFindFileNameW
wnsprintfA
StrToIntExA
PathAppendA
PathFileExistsA
StrToInt64ExW
SHGetValueA
StrCmpIW
StrStrIA
SHDeleteValueA
PathIsNetworkPathW
PathAddBackslashW

psapi

GetModuleFileNameExW

crypt32

CertCloseStore
CertFreeCertificateContext
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFindCertificateInStore
CertDuplicateCertificateContext

netapi32

NetApiBufferFree
Netbios
NetUserGetInfo

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo

wldap32

ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord142
ord79
ord147
ord167
ord133
ord14
ord46
ord219
ord145
ord301

gdi32

DeleteObject
DeleteDC
GetTextMetricsW
GetStockObject
CreateFontW
CreateDIBSection
CreateCompatibleDC
SelectObject
GetDeviceCaps
Ellipse
GetObjectA

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoSetProxyBlanket

oleaut32

SysAllocString
SysFreeString

gdiplus

GdipGetPenBrushFill
GdipSetSmoothingMode
GdipAlloc
GdipDeleteBrush
GdipCreateFontFromLogfontA
GdipSetCompositingQuality
GdipCreateStringFormat
GdipFillEllipseI
GdipCreateFontFromDC
GdipFree
GdipDrawString
GdipResetWorldTransform
GdipCreateFromHDC
GdipSetTextRenderingHint
GdipRotateWorldTransform
GdipCloneBrush
GdipDeleteGraphics
GdipDeleteStringFormat
GdipDeleteFont
GdipTranslateWorldTransform
GdipDeletePen
GdipCreatePen1
GdipSetStringFormatAlign
GdipGetPenFillType

Exports

Exports

Helper_GetGuid
Helper_UnzipFile
Packer_PackFile
Viewer_Exit
Viewer_FileOpenIncrement
Viewer_GetZipJson
Viewer_InitEnv
Viewer_OpenFile

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 532KB - Virtual size: 531KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 250KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/NSEC.Common.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\.Net-Common\.Net\NSEC.Common\NSEC.Common\obj\Release\net452\NSEC.Common.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/NSEC.Util.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\.Net-Common\.Net\NSEC.Util\NSEC.Util\obj\Debug\net452\NSEC.Util.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 185KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/NSec.ScanFile.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b7:d9:fc:26:fe:4c:00:e7:37:fe:2b:50:96:65:1a:a7:dd:35:43:3f:73:b6:5f:ee:3a:51:e6:43:9a:b2:4e:83
Signer

Actual PE Digest

b7:d9:fc:26:fe:4c:00:e7:37:fe:2b:50:96:65:1a:a7:dd:35:43:3f:73:b6:5f:ee:3a:51:e6:43:9a:b2:4e:83

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\ManagementPlatform\Nx.UI.Agent\NSec.ScanFile\obj\Release\NSec.ScanFile.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/NSecRTX2.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a2:f8:2b:61:00:9a:87:14:22:ea:25:9b:a7:1d:9c:73:f4:00:88:bd:07:08:81:00:43:31:1e:73:62:cd:30:99
Signer

Actual PE Digest

a2:f8:2b:61:00:9a:87:14:22:ea:25:9b:a7:1d:9c:73:f4:00:88:bd:07:08:81:00:43:31:1e:73:62:cd:30:99

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\Common\SuperTools\NSecRTX2\NSecRTX\obj\Release\NSecRTX2.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/NSecUI.AppStore.Client.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Client\NSecUI.AppStore\NSecUI.AppStore.Client\obj\Release\NSecUI.AppStore.Client.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/NSecUI.AppStore.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:d2:11:40:38:13:03:56:39:06:d7:0d:8e:c0:8e:bf:54:3a:48:2d:ff:ed:e1:65:24:5f:f0:3d:98:fc:e9:40
Signer

Actual PE Digest

08:d2:11:40:38:13:03:56:39:06:d7:0d:8e:c0:8e:bf:54:3a:48:2d:ff:ed:e1:65:24:5f:f0:3d:98:fc:e9:40

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Client\Client-NSecEx\NSecUI.AppStore\NSecUI.AppStore\obj\Release\NSecUI.AppStore.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 477KB - Virtual size: 476KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/NSecUI.Core.dll
.dll .wsf windows:4 windows x86 arch:x86 polyglot

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\ManagementPlatform\Nx.UI.Agent\NSecUI.Core\obj\Release\NSecUI.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/NSecUI.Info.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\ManagementPlatform\Nx.UI.Agent\NSecUI.Info\obj\Release\NSecUI.Info.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 365KB - Virtual size: 364KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/NSecUI.Popup.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

32:b0:09:1d:c3:36:96:41:0d:1e:e1:c5:1c:47:7e:b9:7e:a7:55:82:1b:39:4f:61:aa:1f:cf:2a:10:c2:5d:62
Signer

Actual PE Digest

32:b0:09:1d:c3:36:96:41:0d:1e:e1:c5:1c:47:7e:b9:7e:a7:55:82:1b:39:4f:61:aa:1f:cf:2a:10:c2:5d:62

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\ManagementPlatform\Nx.UI.Agent\NSecUI.Popup\obj\Release\NSecUI.Popup.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 313KB - Virtual size: 312KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/NSecUI.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:2a:ab:69:e1:e2:a8:a5:e3:35:54:aa:35:1c:5f:e5:92:b0:07:8d:b5:21:56:a6:b2:5f:4c:ed:f4:23:e4:a5
Signer

Actual PE Digest

68:2a:ab:69:e1:e2:a8:a5:e3:35:54:aa:35:1c:5f:e5:92:b0:07:8d:b5:21:56:a6:b2:5f:4c:ed:f4:23:e4:a5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\ManagementPlatform\Nx.UI.Agent\NSecUI\obj\Release\NSecUI.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 3.9MB - Virtual size: 3.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/NSecsoft.NativeModule.dll
.dll windows:5 windows x86 arch:x86

55d83c5347d113e22705d59d129dc276

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Client\Client-CommonLibs\NSecsoft.NativeModule\Release\x86\NSecsoft.NativeModule.pdb

Imports

kernel32

ResetEvent
SystemTimeToTzSpecificLocalTime
GetCurrentDirectoryW
DisableThreadLibraryCalls
GetLocalTime
GetFileTime
GetCurrentProcessId
FileTimeToLocalFileTime
CloseHandle
FileTimeToSystemTime
GetLastError
OpenProcess
CreateFileW
ReadFile
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
CreateDirectoryW
SetStdHandle
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FormatMessageW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
CreateMutexW
WaitForSingleObject
LocalFree
CreateProcessW
OpenMutexW
GetExitCodeProcess
GetLogicalDrives
HeapFree
GetDriveTypeA
GetVolumeInformationA
CreateFileA
HeapAlloc
SetFileAttributesA
GetComputerNameW
GetProcessHeap
GetPrivateProfileStringA
InterlockedDecrement
HeapSize
HeapReAlloc
RaiseException
HeapDestroy
QueryDosDeviceW
ReleaseMutex
DeleteFileW
MoveFileExW
SizeofResource
EnumResourceTypesW
WriteFile
EnumResourceNamesW
GetTempPathW
LockResource
LoadResource
FindResourceW
FreeLibrary
LoadLibraryExW
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
SetFileAttributesW
Sleep
GetDriveTypeW
DeleteFileA
GetModuleFileNameW
GetModuleFileNameA
InitializeCriticalSection
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
GetSystemInfo
LoadLibraryW
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSize
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
SetEvent
FindFirstFileW
FindNextFileW
DeviceIoControl
FindClose
LocalAlloc
GetModuleHandleA
GetFileSizeEx
GetSystemDirectoryA
SetFilePointerEx
TerminateThread
QueueUserAPC
SleepEx
RtlUnwind
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
WriteConsoleW
CreateThread
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExA
FindNextFileA

user32

GetProcessWindowStation
MessageBoxW
GetUserObjectInformationW
FindWindowExA
GetWindowThreadProcessId
wsprintfA

advapi32

SetEntriesInAclW
AllocateAndInitializeSid
RegCloseKey
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
DuplicateTokenEx
SetThreadToken
OpenProcessToken
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
RegOpenKeyExW
InitializeSecurityDescriptor
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
LookupPrivilegeValueW
AdjustTokenPrivileges
SetFileSecurityW
ConvertSidToStringSidA
RegQueryValueExA
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExA

shell32

SHCreateDirectoryExW
SHCreateDirectoryExA
ShellExecuteExW
SHGetSpecialFolderPathW

shlwapi

StrToInt64ExA
PathFindFileNameW
StrToIntExA
PathFindFileNameA
wvnsprintfA
PathAppendW
PathFileExistsA
PathIsNetworkPathW
SHDeleteValueW
StrCpyW
wnsprintfA
PathFileExistsW
wnsprintfW
PathFindExtensionW
SHSetValueA
StrCmpIW
PathIsDirectoryW

iphlpapi

GetAdaptersAddresses

netapi32

Netbios

ws2_32

closesocket
WSAIoctl
bind
send
WSAEnumNetworkEvents
WSAEventSelect
getpeername
getsockname
WSACloseEvent
ntohs
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
recvfrom
sendto
WSACreateEvent
WSASetLastError
gethostname
inet_ntoa
gethostbyname
WSAGetLastError
setsockopt
htons
recv
connect
socket
inet_addr
getsockopt
ioctlsocket
getnameinfo
shutdown
freeaddrinfo

crypt32

CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CertCloseStore
CryptQueryObject
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertFreeCertificateContext
CryptMsgClose
CertOpenStore
CertOpenSystemStoreW
CertGetIntendedKeyUsage
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage

wldap32

ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

ole32

CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitialize

oleaut32

SysAllocString
SysFreeString

Exports

Exports

DesDecryptFile
DesDtd
DesEncryptFile
DesGetFileMetaInfo
DesImportOfflinePolicy
DesIsFileEncrypted
DesRecordDecReason
DesRecordEnc
DesSetFileMetaInfo
FsGetFileTime2
GetConsoleServerHost
GetCurrentProcessUserSID
GetGlobalID
GetUid
GetUserSID
GetValueFromMMKV
GetValueFromMMKVEx
GetZenServerHost
ImageExtractFileIcon
ImpersonateExplorerToken
IsZipFile
PeGetFileDigitalSign2
PeGetFileInfo2
ReleaseValueFromMMKV
SeSetPrivilege
SetValueToMMKV
SetValueToMMKVEx
ShExcuteW2
xConfigDestroy
xConfigInit
xConfigSet

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 500KB - Virtual size: 500KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/NSecsoft.Ping32.DocSec.API.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Client\Client-NSecRTX\NSecRTX2\NSecsoft.Ping32.DocSec.API.Core\obj\Release\NSecsoft.Ping32.DocSec.API.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/Newtonsoft.Json.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

27/04/2018, 12:41

Not After

27/04/2028, 12:41

Subject

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Certificate

Issuer

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

Not Before

25/10/2018, 00:00

Not After

29/10/2021, 12:00

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:83:93:14:a9:06:f5:64:04:02:a1:dc:eb:a3:1a:a7:e9:21:c8:88:2c:dd:c2:3c:e4:c0:45:50:4c:ee:75:10
Signer

Actual PE Digest

2e:83:93:14:a9:06:f5:64:04:02:a1:dc:eb:a3:1a:a7:e9:21:c8:88:2c:dd:c2:3c:e4:c0:45:50:4c:ee:75:10

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 675KB - Virtual size: 675KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/Nx.UI.Client.Approval.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\ManagementPlatform\Nx.UI.Collection\Nx.UI.Client.Approval\obj\Release\Nx.UI.Client.Approval.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/Nx.UI.Client.Common.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\ManagementPlatform\Nx.UI.Collection\Nx.UI.Client.Common\obj\Release\Nx.UI.Client.Common.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 380KB - Virtual size: 380KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/Nx.UI.Client.Resource.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\ManagementPlatform\Nx.UI.Common\Nx.UI.Client.Resource\obj\Release\Nx.UI.Client.Resource.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 54KB - Virtual size: 54KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/Nx.UI.MessageCenter.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ec:5b:dd:ff:86:d4:ca:8c:ba:60:ec:ee:66:68:b4:9b:d2:19:bf:ee:3e:40:35:4e:99:5a:bc:12:21:01:8a:a6
Signer

Actual PE Digest

ec:5b:dd:ff:86:d4:ca:8c:ba:60:ec:ee:66:68:b4:9b:d2:19:bf:ee:3e:40:35:4e:99:5a:bc:12:21:01:8a:a6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\ManagementPlatform\Ping32DocSec\Nx.UI.MessageCenter\Nx.UI.MessageCenter\obj\Release\Nx.UI.MessageCenter.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 82KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/Nx.UI.SupportTicket.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

92:be:f6:fb:8c:b3:12:8e:63:71:1c:27:7c:96:a9:46:96:fb:42:0b:ea:31:f4:d0:42:c3:83:6f:39:dd:ce:d9
Signer

Actual PE Digest

92:be:f6:fb:8c:b3:12:8e:63:71:1c:27:7c:96:a9:46:96:fb:42:0b:ea:31:f4:d0:42:c3:83:6f:39:dd:ce:d9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Client\Client-NSecEx\Nx.UI.WorkOrder\Nx.UI.SupportTicket\obj\Debug\Nx.UI.SupportTicket.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 348KB - Virtual size: 347KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/Nx.UI.Toolset.FileMaker.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

19:c4:6c:ff:a0:e7:d7:46:a4:4f:82:91:e0:de:2f:12:7d:4f:32:90:6d:16:45:96:dc:16:2f:fd:b1:f8:9f:8c
Signer

Actual PE Digest

19:c4:6c:ff:a0:e7:d7:46:a4:4f:82:91:e0:de:2f:12:7d:4f:32:90:6d:16:45:96:dc:16:2f:fd:b1:f8:9f:8c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\ManagementPlatform\Ping32DocSec\Nx.UI.Toolset.FileMaker\Nx.UI.Toolset.FileMaker\obj\Debug\Nx.UI.Toolset.FileMaker.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 420KB - Virtual size: 419KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/Nx.UI.Toolset.Watermark.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\ManagementPlatform\Ping32DocSec\Nx.UI.Toolset.Watermark\obj\Debug\Nx.UI.Toolset.Watermark.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 92KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/Nx.UI.WorkOrderMessage.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Client\Client-NSecEx\Nx.UI.WorkOrder\Nx.UI.WorkOrderMessage\obj\Debug\Nx.UI.WorkOrderMessage.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/OpenMcdf.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Federico\Source\Repos\ironfede\openmcdf-main\sources\OpenMcdf\obj\Release\net40\OpenMcdf.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/Resources/appstore.ico
plugins/NSecUI/Resources/appstore.png
.png
plugins/NSecUI/Resources/default.ico
plugins/NSecUI/RestSharp.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\RestSharp\RestSharp\src\RestSharp\obj\Release\net452\RestSharp.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/RtfPipe.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\a\1\s\RtfPipe\obj\Release\net45\RtfPipe.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 177KB - Virtual size: 177KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/System.Buffers.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ed:d0:e0:df:c8:a1:f2:86:2e:5e:07:95:e6:59:af:43:a5:5d:5d:54:50:a7:8a:ec:33:2d:4a:60:2b:cc:64:83
Signer

Actual PE Digest

ed:d0:e0:df:c8:a1:f2:86:2e:5e:07:95:e6:59:af:43:a5:5d:5d:54:50:a7:8a:ec:33:2d:4a:60:2b:cc:64:83

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netstandard1.1\System.Buffers.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/System.Data.DataSetExtensions.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

76:26:d3:02:cc:8e:8a:53:74:e6:51:11:dc:d5:3a:9a:88:ff:3e:80:1f:1d:d3:3c:f1:2a:73:64:17:95:98:c9
Signer

Actual PE Digest

76:26:d3:02:cc:8e:8a:53:74:e6:51:11:dc:d5:3a:9a:88:ff:3e:80:1f:1d:d3:3c:f1:2a:73:64:17:95:98:c9

Digest Algorithm

sha256

PE Digest Matches

true

d0:88:e7:bc:59:55:65:2b:f3:d5:24:2a:2f:b4:42:b0:22:82:89:50
Signer

Actual PE Digest

d0:88:e7:bc:59:55:65:2b:f3:d5:24:2a:2f:b4:42:b0:22:82:89:50

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/System.Data.Linq.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/11/2013, 22:11

Not After

11/02/2015, 22:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

81:43:62:ad:d5:66:5a:20:76:1a:b3:36:d8:86:87:9c:23:ba:81:2f:52:0b:68:70:00:07:f3:cf:a8:f2:6c:37
Signer

Actual PE Digest

81:43:62:ad:d5:66:5a:20:76:1a:b3:36:d8:86:87:9c:23:ba:81:2f:52:0b:68:70:00:07:f3:cf:a8:f2:6c:37

Digest Algorithm

sha256

PE Digest Matches

true

63:63:91:53:9a:0b:13:7b:52:6f:4a:7a:43:40:d4:14:e6:64:42:0b
Signer

Actual PE Digest

63:63:91:53:9a:0b:13:7b:52:6f:4a:7a:43:40:d4:14:e6:64:42:0b

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 198KB - Virtual size: 198KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/System.Data.SQLite.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

01/10/2021, 00:00

Not After

12/12/2024, 23:59

Subject

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

01/10/2021, 00:00

Not After

12/12/2024, 23:59

Subject

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fd:a9:bb:d5:82:65:9e:b4:45:d2:69:63:94:ed:84:f9:2a:6c:af:ad:7f:f8:37:72:f5:84:86:6b:e2:a7:f4:e2:41:8b:39:7d:59:08:64:9a:85:85:e6:df:92:f5:e6:ea:c9:40:9c:22:9b:ae:89:0d:13:88:ad:70:ae:22:22:bc
Signer

Actual PE Digest

fd:a9:bb:d5:82:65:9e:b4:45:d2:69:63:94:ed:84:f9:2a:6c:af:ad:7f:f8:37:72:f5:84:86:6b:e2:a7:f4:e2:41:8b:39:7d:59:08:64:9a:85:85:e6:df:92:f5:e6:ea:c9:40:9c:22:9b:ae:89:0d:13:88:ad:70:ae:22:22:bc

Digest Algorithm

sha512

PE Digest Matches

true

66:dc:4a:40:17:63:40:7d:e0:e4:b6:43:cb:ad:c4:f7:e5:60:a1:70
Signer

Actual PE Digest

66:dc:4a:40:17:63:40:7d:e0:e4:b6:43:cb:ad:c4:f7:e5:60:a1:70

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\dev\sqlite\dotnet-private\obj\2013\System.Data.SQLite.2013\Release\System.Data.SQLite.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 380KB - Virtual size: 379KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/System.Data.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/11/2013, 22:11

Not After

11/02/2015, 22:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

37:ab:16:b9:2f:1a:c7:80:95:4b:dd:65:6c:bc:f0:d7:d3:10:19:35:79:68:63:7e:16:8a:42:9b:3d:b4:21:8d
Signer

Actual PE Digest

37:ab:16:b9:2f:1a:c7:80:95:4b:dd:65:6c:bc:f0:d7:d3:10:19:35:79:68:63:7e:16:8a:42:9b:3d:b4:21:8d

Digest Algorithm

sha256

PE Digest Matches

true

18:fb:70:65:6c:48:16:f2:d1:86:8d:45:16:6e:3a:1d:fc:79:82:24
Signer

Actual PE Digest

18:fb:70:65:6c:48:16:f2:d1:86:8d:45:16:6e:3a:1d:fc:79:82:24

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/System.Deployment.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

94:23:6e:5c:f9:89:04:65:51:8f:05:92:f5:a9:4b:fe:db:ce:b0:54:33:89:d5:8d:f4:82:32:ad:ca:69:50:db
Signer

Actual PE Digest

94:23:6e:5c:f9:89:04:65:51:8f:05:92:f5:a9:4b:fe:db:ce:b0:54:33:89:d5:8d:f4:82:32:ad:ca:69:50:db

Digest Algorithm

sha256

PE Digest Matches

true

34:b8:91:2f:1f:d6:b5:7f:72:b9:5d:03:cb:da:73:32:d2:71:34:af
Signer

Actual PE Digest

34:b8:91:2f:1f:d6:b5:7f:72:b9:5d:03:cb:da:73:32:d2:71:34:af

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 522KB - Virtual size: 522KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/System.Drawing.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

35:74:f1:00:4e:b4:8f:de:4d:67:fd:eb:3b:81:11:4e:09:f9:a4:ca:31:35:4f:3b:37:88:bb:4f:98:e8:59:62
Signer

Actual PE Digest

35:74:f1:00:4e:b4:8f:de:4d:67:fd:eb:3b:81:11:4e:09:f9:a4:ca:31:35:4f:3b:37:88:bb:4f:98:e8:59:62

Digest Algorithm

sha256

PE Digest Matches

true

38:b0:4f:a4:50:41:80:65:92:ab:aa:e8:ed:c2:de:2e:e8:8f:a0:67
Signer

Actual PE Digest

38:b0:4f:a4:50:41:80:65:92:ab:aa:e8:ed:c2:de:2e:e8:8f:a0:67

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 167KB - Virtual size: 166KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/System.Management.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:a8:8c:f0:18:86:db:b1:6e:d9:c7:1d:ab:dd:d8:76:12:ab:a5:f6:eb:85:fa:ca:15:bd:14:9b:14:c7:14:77
Signer

Actual PE Digest

61:a8:8c:f0:18:86:db:b1:6e:d9:c7:1d:ab:dd:d8:76:12:ab:a5:f6:eb:85:fa:ca:15:bd:14:9b:14:c7:14:77

Digest Algorithm

sha256

PE Digest Matches

true

26:6e:31:f9:bd:3f:d0:2f:38:9d:e2:e7:ca:1a:94:95:70:64:dc:08
Signer

Actual PE Digest

26:6e:31:f9:bd:3f:d0:2f:38:9d:e2:e7:ca:1a:94:95:70:64:dc:08

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/System.Net.Http.Formatting.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:08

Not After

26/07/2019, 20:08

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

50:f7:ba:6f:12:20:c7:5e:88:33:d9:bd:f4:e2:34:26:9a:b1:46:f4:59:52:31:5b:5e:c4:07:b0:0b:ac:b8:86
Signer

Actual PE Digest

50:f7:ba:6f:12:20:c7:5e:88:33:d9:bd:f4:e2:34:26:9a:b1:46:f4:59:52:31:5b:5e:c4:07:b0:0b:ac:b8:86

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\BuildAgent\work\8f8721ff33b44e63\Tooling\obj\Release\System.Net.Http.Formatting\System.Net.Http.Formatting.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 163KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/System.Net.Http.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4f:2b:a3:3d:31:44:34:92:31:93:71:56:cb:fc:fe:65:c0:0c:72:9a:0c:14:3b:08:4b:44:26:c5:6d:46:44:52
Signer

Actual PE Digest

4f:2b:a3:3d:31:44:34:92:31:93:71:56:cb:fc:fe:65:c0:0c:72:9a:0c:14:3b:08:4b:44:26:c5:6d:46:44:52

Digest Algorithm

sha256

PE Digest Matches

true

94:f9:d2:7f:29:18:30:36:cb:47:5a:d6:8a:26:a7:1e:36:67:4c:ca
Signer

Actual PE Digest

94:f9:d2:7f:29:18:30:36:cb:47:5a:d6:8a:26:a7:1e:36:67:4c:ca

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/System.Security.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a6:27:a2:30:54:e1:cf:77:01:d9:4e:a0:4e:26:c9:c8:ae:ff:82:37:8d:6e:63:7c:ab:a0:c0:e5:60:72:d9:c5
Signer

Actual PE Digest

a6:27:a2:30:54:e1:cf:77:01:d9:4e:a0:4e:26:c9:c8:ae:ff:82:37:8d:6e:63:7c:ab:a0:c0:e5:60:72:d9:c5

Digest Algorithm

sha256

PE Digest Matches

true

2c:5b:0d:12:6e:ca:98:f9:1d:5b:28:0c:8d:6e:e2:73:5b:83:0e:b4
Signer

Actual PE Digest

2c:5b:0d:12:6e:ca:98:f9:1d:5b:28:0c:8d:6e:e2:73:5b:83:0e:b4

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/System.Web.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/11/2013, 22:11

Not After

11/02/2015, 22:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

be:1d:ce:d5:18:fd:8b:96:d4:52:be:4f:5d:a5:12:2f:21:6f:ac:65:d4:35:ed:2f:be:e7:a8:2c:97:a0:0d:38
Signer

Actual PE Digest

be:1d:ce:d5:18:fd:8b:96:d4:52:be:4f:5d:a5:12:2f:21:6f:ac:65:d4:35:ed:2f:be:e7:a8:2c:97:a0:0d:38

Digest Algorithm

sha256

PE Digest Matches

true

0f:3d:2b:03:75:09:f3:0c:95:2f:8c:f8:27:45:e6:6c:c5:2a:11:b1
Signer

Actual PE Digest

0f:3d:2b:03:75:09:f3:0c:95:2f:8c:f8:27:45:e6:6c:c5:2a:11:b1

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/System.Windows.Forms.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:4c:a1:e8:4d:cc:b4:74:7b:3b:00:00:00:00:00:4c
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/11/2013, 22:11

Not After

11/02/2015, 22:11

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:C0F4-3086-DEF8,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

da:a1:67:ba:8d:bf:48:e7:70:d2:e7:bb:ee:3c:4c:bc:e0:54:31:f2:86:c5:66:e4:6f:14:fa:0e:58:e2:0d:17
Signer

Actual PE Digest

da:a1:67:ba:8d:bf:48:e7:70:d2:e7:bb:ee:3c:4c:bc:e0:54:31:f2:86:c5:66:e4:6f:14:fa:0e:58:e2:0d:17

Digest Algorithm

sha256

PE Digest Matches

true

41:24:13:d7:95:3c:6a:04:14:71:f2:49:96:84:9b:a3:30:68:e0:da
Signer

Actual PE Digest

41:24:13:d7:95:3c:6a:04:14:71:f2:49:96:84:9b:a3:30:68:e0:da

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/System.Xml.Linq.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d9:f9:7b:29:8e:b1:b1:c1:e7:70:95:da:ee:00:b4:2e:c8:59:9e:2a:1d:7f:c0:7b:96:53:7b:0b:bd:c4:01:37
Signer

Actual PE Digest

d9:f9:7b:29:8e:b1:b1:c1:e7:70:95:da:ee:00:b4:2e:c8:59:9e:2a:1d:7f:c0:7b:96:53:7b:0b:bd:c4:01:37

Digest Algorithm

sha256

PE Digest Matches

true

6f:d1:41:7c:9c:a1:ef:13:4c:dd:38:8a:9a:08:df:c3:d5:db:cd:d7
Signer

Actual PE Digest

6f:d1:41:7c:9c:a1:ef:13:4c:dd:38:8a:9a:08:df:c3:d5:db:cd:d7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/System.Xml.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:33:e5:27:86:a3:0e:4a:2a:80:00:00:00:00:00:33
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:F528-3777-8A76,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

30:bc:87:63:28:da:04:ff:90:d7:37:8a:54:65:3a:1b:e2:24:90:ed:56:31:39:30:00:70:44:5f:12:8d:ce:f7
Signer

Actual PE Digest

30:bc:87:63:28:da:04:ff:90:d7:37:8a:54:65:3a:1b:e2:24:90:ed:56:31:39:30:00:70:44:5f:12:8d:ce:f7

Digest Algorithm

sha256

PE Digest Matches

true

ed:60:a9:64:d2:7f:27:84:ff:bb:14:7a:35:8a:ba:76:c0:8e:18:42
Signer

Actual PE Digest

ed:60:a9:64:d2:7f:27:84:ff:bb:14:7a:35:8a:ba:76:c0:8e:18:42

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 882KB - Virtual size: 882KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/System.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:34:24:31:40:c9:a0:c1:79:8d:00:00:00:00:00:34
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

27/03/2013, 20:08

Not After

27/06/2014, 20:08

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:B8EC-30A4-7144,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:00:ca:6c:d5:32:12:35:c4:e1:55:00:01:00:00:00:ca
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/04/2014, 17:39

Not After

22/07/2015, 17:39

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:1a:77:bb:74:b3:07:d1:16:b8:00:00:00:00:00:1a
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

24/09/2013, 17:41

Not After

24/12/2014, 17:41

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

70:60:94:46:9c:f2:fb:46:ca:2a:06:ba:89:62:e4:d0:49:b4:b5:2e:b4:f3:aa:d6:2f:e8:e9:b7:8a:8c:74:7b
Signer

Actual PE Digest

70:60:94:46:9c:f2:fb:46:ca:2a:06:ba:89:62:e4:d0:49:b4:b5:2e:b4:f3:aa:d6:2f:e8:e9:b7:8a:8c:74:7b

Digest Algorithm

sha256

PE Digest Matches

true

8a:a6:04:7c:58:a4:3f:72:11:d1:6b:fd:64:df:f1:93:1a:0e:08:29
Signer

Actual PE Digest

8a:a6:04:7c:58:a4:3f:72:11:d1:6b:fd:64:df:f1:93:1a:0e:08:29

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/WinDiskMgr.dll
.dll windows:5 windows x86 arch:x86

5d8268a14c68bb2751ac6b2942d6cd85

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\WinDiskMgr.pdb

Imports

kernel32

SystemTimeToTzSpecificLocalTime
DisableThreadLibraryCalls
ProcessIdToSessionId
GetTickCount
DeleteCriticalSection
DeleteFileW
CreateFileW
GetVolumeInformationA
GetLastError
SetFilePointer
LocalFree
QueueUserAPC
ResetEvent
WaitForSingleObjectEx
SetEvent
CreateEventW
WaitForSingleObject
GetDriveTypeA
DeviceIoControl
GetCurrentProcessId
OpenMutexW
DeleteFileA
Sleep
QueueUserWorkItem
CreateMutexW
InitializeCriticalSection
LeaveCriticalSection
WriteFile
EnterCriticalSection
CloseHandle
CreateFileA
GetFileAttributesExA
CreateDirectoryW
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetLogicalDrives
ReadFile
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
MoveFileExW
QueryPerformanceFrequency
SetStdHandle
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
FormatMessageW
WideCharToMultiByte
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
SetFileAttributesW
GetDriveTypeW
GetLocalTime
OpenEventW
GetModuleFileNameW
HeapFree
HeapAlloc
SetFileAttributesA
GetComputerNameW
GetProcessHeap
GetPrivateProfileStringA
GetSystemDirectoryW
GetModuleFileNameA
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
ReleaseMutex
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
GetVersionExA
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSize
SystemTimeToFileTime
FreeLibrary
GetSystemTime
FormatMessageA
FlushFileBuffers
GetFileSizeEx
GetSystemDirectoryA
SetFilePointerEx
FindFirstFileW
FindNextFileW
QueryDosDeviceA
FindClose
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
Process32NextW
FileTimeToSystemTime
Process32FirstW
LoadLibraryExW
TerminateThread
SleepEx
CreateThread
RtlUnwind
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
ExitThread
FreeLibraryAndExitThread
GetStdHandle
GetFileType
WriteConsoleW
SetConsoleCtrlHandler
GetCurrentDirectoryW

advapi32

RegCreateKeyExA
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
SetSecurityDescriptorDacl
GetTokenInformation
OpenProcessToken
RegQueryValueExW
DuplicateTokenEx
ConvertSidToStringSidW
CreateProcessAsUserW
RegOpenKeyExW
RegCloseKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExA
RegEnumKeyA
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
LookupPrivilegeValueW
SetFileSecurityW
RegQueryValueExA
RegSetValueExA

shlwapi

StrStrIA
SHGetValueA
PathAppendW
PathFileExistsW
SHDeleteValueA
SHEnumValueA
PathAppendA
PathFindFileNameA
PathAddBackslashA
SHEnumKeyExA
PathFileExistsA
PathFindFileNameW
wvnsprintfA
StrToIntExA
wnsprintfA
SHEnumKeyExW
SHGetValueW
wnsprintfW
SHSetValueA
SHSetValueW
SHDeleteValueW
SHDeleteKeyA

ws2_32

recv
htons
setsockopt
WSAGetLastError
gethostname
gethostbyname
inet_ntoa
getpeername
getsockname
getsockopt
WSAWaitForMultipleEvents
WSAStartup
connect
socket
inet_addr
ioctlsocket
getnameinfo
shutdown
WSACleanup
__WSAFDIsSet
select
accept
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
WSASetLastError
WSACreateEvent
WSACloseEvent
closesocket
WSAIoctl
bind
WSAResetEvent
send
WSAEnumNetworkEvents
ntohs
WSAEventSelect
htonl

iphlpapi

GetAdaptersAddresses

crypt32

CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertDuplicateCertificateContext

wldap32

ord79
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145
ord301
ord147
ord133
ord142

netapi32

Netbios

wtsapi32

WTSQueryUserToken

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

user32

GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
wsprintfA

shell32

SHCreateDirectoryExW
SHCreateDirectoryExA
SHGetSpecialFolderPathW

ole32

CoCreateGuid

Exports

Exports

CheckCryptVolume
DiskCryptPolicyHandler
DiskCryptPolicyHandlerEx
GetUDFriendlyName
GetUDiskTypeIDA
GetVirtualVolumeList
InitDiskCryptImlp
IsRegisteredUDisk
IsUSBDrive
IsVirtualVolume
MountVolume
ROUD_FsFltRestartHandlerEx
ReadUDiskIDA
ReadUDiskIDAEx
StartUsbInsertAndExtractCheckService
UDiskAccessCtrlHandlerEx
UDiskAlertPolicyHandlerEx
UnmountVolume
UpdateDiskCryptKEY
WriteUDiskIDA
WriteUDiskIDAEx

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 522KB - Virtual size: 521KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/XOR.API.Doc.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Common\SuperTools\NSecRTX2\XOR.API.Doc\obj\Release\XOR.API.Doc.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/XOR.API.WMI.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Common\SuperTools\NSecRTX2\XOR.API.WMI\obj\Release\XOR.API.WMI.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/en/NSec.ScanFile.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 506KB - Virtual size: 505KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/en/NSecUI.AppStore.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/en/NSecUI.Info.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/en/NSecUI.Popup.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/en/NSecUI.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 383KB - Virtual size: 383KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/en/Nx.UI.Client.Approval.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/en/Nx.UI.Client.Common.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/en/Nx.UI.Client.Resource.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/en/Nx.UI.MessageCenter.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/en/Nx.UI.SupportTicket.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/en/Nx.UI.Toolset.FileMaker.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 276KB - Virtual size: 276KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/en/Nx.UI.Toolset.Watermark.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/en/Nx.UI.WorkOrderMessage.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/nativetool.exe
.exe windows:5 windows x86 arch:x86

1869dacfc289e6475689d06ed5f88574

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

46:05:55:97:ef:db:28:12:2d:3c:1d:54:b3:9b:66:1c:a5:4e:cb:eb:f7:75:d1:f6:b6:9a:ee:84:4e:e6:74:66
Signer

Actual PE Digest

46:05:55:97:ef:db:28:12:2d:3c:1d:54:b3:9b:66:1c:a5:4e:cb:eb:f7:75:d1:f6:b6:9a:ee:84:4e:e6:74:66

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
HeapCreate
ReadFile
AreFileApisANSI
GetCurrentThreadId
InitializeCriticalSection
EnterCriticalSection
WaitForSingleObject
TryEnterCriticalSection
DeleteCriticalSection
FindClose
GetModuleFileNameW
FindFirstFileW
FindNextFileW
GetFullPathNameW
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
WriteFile
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LocalFree
LockFileEx
GetFileSize
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
GetFileAttributesA
CreateMutexW
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
LeaveCriticalSection
FlushFileBuffers
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileA
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
OpenProcess
LoadLibraryExW
GetModuleFileNameA
GetFileSizeEx
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
SetFilePointerEx
InterlockedDecrement
RaiseException
RtlUnwind
GetStdHandle
GetFileType
GetModuleHandleExW
WriteConsoleW
CreateThread
ExitThread
FreeLibraryAndExitThread
ExitProcess
GetCommandLineA
GetCommandLineW
GetACP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExA

shlwapi

PathIsNetworkPathW
PathFindFileNameA
SHSetValueA
wvnsprintfA
wnsprintfA
wnsprintfW
PathAppendW
PathFindExtensionW

user32

wsprintfA

advapi32

GetTokenInformation
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExW
OpenProcessToken
RegCloseKey

shell32

SHCreateDirectoryExA

ole32

CoInitialize
CoUninitialize
CoCreateInstance
CoSetProxyBlanket

oleaut32

SysAllocString
SysFreeString

Sections

.text
Size: 785KB - Virtual size: 785KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 122KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/x64/NSecsoft.NativeModule.dll
.dll windows:5 windows x64 arch:x64

f18b79ada9e3dacbc9b6cf18cea6063d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Client\Client-CommonLibs\NSecsoft.NativeModule\Release\x64\NSecsoft.NativeModule.pdb

Imports

kernel32

RtlUnwind
ResetEvent
SystemTimeToTzSpecificLocalTime
GetCurrentDirectoryW
DisableThreadLibraryCalls
GetLocalTime
GetFileTime
GetCurrentProcessId
FileTimeToLocalFileTime
CloseHandle
FileTimeToSystemTime
GetLastError
OpenProcess
CreateFileW
ReadFile
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
CreateDirectoryW
SetStdHandle
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FormatMessageW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
CreateMutexW
WaitForSingleObject
LocalFree
CreateProcessW
OpenMutexW
GetExitCodeProcess
GetLogicalDrives
HeapFree
GetDriveTypeA
GetVolumeInformationA
CreateFileA
HeapAlloc
SetFileAttributesA
GetComputerNameW
GetProcessHeap
GetPrivateProfileStringA
HeapSize
HeapReAlloc
RaiseException
HeapDestroy
QueryDosDeviceW
ReleaseMutex
DeleteFileW
MoveFileExW
SizeofResource
EnumResourceTypesW
WriteFile
EnumResourceNamesW
GetTempPathW
LockResource
LoadResource
FindResourceW
FreeLibrary
LoadLibraryExW
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
SetFileAttributesW
Sleep
GetDriveTypeW
DeleteFileA
GetModuleFileNameW
GetModuleFileNameA
InitializeCriticalSection
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
GetSystemInfo
LoadLibraryW
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSize
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
SetEvent
FindFirstFileW
FindNextFileW
DeviceIoControl
FindClose
LocalAlloc
GetModuleHandleA
GetFileSizeEx
GetSystemDirectoryA
SetFilePointerEx
TerminateThread
QueueUserAPC
SleepEx
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
WriteConsoleW
CreateThread
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExA
FindNextFileA

user32

GetProcessWindowStation
MessageBoxW
FindWindowExA
GetWindowThreadProcessId
GetUserObjectInformationW
wsprintfA

advapi32

SetEntriesInAclW
AllocateAndInitializeSid
RegCloseKey
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
DuplicateTokenEx
SetThreadToken
OpenProcessToken
RegOpenKeyExW
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
InitializeSecurityDescriptor
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
LookupPrivilegeValueW
AdjustTokenPrivileges
SetFileSecurityW
ConvertSidToStringSidA
RegQueryValueExA
RegCreateKeyExW
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExA
RegSetValueExW

shell32

ShellExecuteExW
SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHCreateDirectoryExA

shlwapi

PathFindFileNameW
StrToIntExA
PathFindFileNameA
wvnsprintfA
PathAppendW
PathFileExistsA
PathIsNetworkPathW
SHDeleteValueW
PathIsDirectoryW
StrCpyW
wnsprintfA
PathFileExistsW
wnsprintfW
PathFindExtensionW
SHSetValueA
StrCmpIW
StrToInt64ExA

iphlpapi

GetAdaptersAddresses

netapi32

Netbios

ws2_32

closesocket
WSAIoctl
bind
send
WSAEnumNetworkEvents
WSAEventSelect
getpeername
getsockname
WSACloseEvent
ntohs
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
recvfrom
sendto
WSACreateEvent
WSASetLastError
gethostname
inet_ntoa
gethostbyname
WSAGetLastError
setsockopt
htons
recv
connect
socket
inet_addr
getsockopt
ioctlsocket
getnameinfo
shutdown
freeaddrinfo

crypt32

CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CertCloseStore
CryptQueryObject
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertFreeCertificateContext
CryptMsgClose
CertOpenStore
CertOpenSystemStoreW
CertGetIntendedKeyUsage
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage

wldap32

ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

ole32

CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitialize

oleaut32

SysAllocString
SysFreeString

Exports

Exports

DesDecryptFile
DesDtd
DesEncryptFile
DesGetFileMetaInfo
DesImportOfflinePolicy
DesIsFileEncrypted
DesRecordDecReason
DesRecordEnc
DesSetFileMetaInfo
FsGetFileTime2
GetConsoleServerHost
GetCurrentProcessUserSID
GetGlobalID
GetUid
GetUserSID
GetValueFromMMKV
GetValueFromMMKVEx
GetZenServerHost
ImageExtractFileIcon
ImpersonateExplorerToken
IsZipFile
PeGetFileDigitalSign2
PeGetFileInfo2
ReleaseValueFromMMKV
SeSetPrivilege
SetValueToMMKV
SetValueToMMKVEx
ShExcuteW2
xConfigDestroy
xConfigInit
xConfigSet

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 738KB - Virtual size: 738KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 75KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 128KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/x64/SQLite.Interop.dll
.dll windows:6 windows x64 arch:x64

c612b9c257a98cb13ae032f71a37699d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

01/10/2021, 00:00

Not After

12/12/2024, 23:59

Subject

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

01/10/2021, 00:00

Not After

12/12/2024, 23:59

Subject

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ee:ab:75:b7:16:96:68:18:a1:86:81:da:07:6c:59:a6:68:bb:32:f1:c5:90:3d:51:58:15:ec:e0:3a:98:f7:e9:90:8b:e6:a9:4f:4b:b9:dd:be:53:31:66:de:27:1e:fc:1e:88:04:55:8a:67:53:31:90:fa:a0:e5:aa:c9:d4:77
Signer

Actual PE Digest

ee:ab:75:b7:16:96:68:18:a1:86:81:da:07:6c:59:a6:68:bb:32:f1:c5:90:3d:51:58:15:ec:e0:3a:98:f7:e9:90:8b:e6:a9:4f:4b:b9:dd:be:53:31:66:de:27:1e:fc:1e:88:04:55:8a:67:53:31:90:fa:a0:e5:aa:c9:d4:77

Digest Algorithm

sha512

PE Digest Matches

true

65:07:33:28:32:6a:5c:62:c0:7c:cc:d7:9c:51:0b:a6:50:d6:58:ac
Signer

Actual PE Digest

65:07:33:28:32:6a:5c:62:c0:7c:cc:d7:9c:51:0b:a6:50:d6:58:ac

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\dev\sqlite\dotnet-private\bin\2013\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb

Imports

mscoree

StrongNameSignatureVerificationEx
StrongNameFreeBuffer
StrongNameErrorInfo
CorBindToRuntimeEx
StrongNameTokenFromAssembly

wintrust

WinVerifyTrust

kernel32

GetEnvironmentVariableW
HeapReAlloc
CreateFileA
GetFileSize
CreateMutexW
HeapCompact
SetFilePointer
TryEnterCriticalSection
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
SetEnvironmentVariableW
QueryPerformanceCounter
HeapFree
WaitForSingleObject
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetModuleHandleW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
HeapDestroy
GetFileAttributesA
GetFullPathNameA
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
lstrlenW
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
lstrcmpiW
lstrcatW
GetFileAttributesExW
DeleteCriticalSection
OutputDebugStringA
GetCurrentThreadId
CloseHandle
SetEnvironmentVariableA
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
CompareStringW
GetFullPathNameW
LCMapStringW
GetConsoleCP
GetConsoleMode
SetFilePointerEx
SetStdHandle
WriteConsoleW
LeaveCriticalSection
DeleteFileW
EncodePointer
DecodePointer
CreateThread
ExitThread
LoadLibraryExW
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetTimeZoneInformation
SetLastError
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
ExitProcess
GetModuleHandleExW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
RtlUnwindEx
GetStdHandle
GetFileType
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
GetStringTypeW

user32

wsprintfW

advapi32

CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptReleaseContext
CryptDeriveKey
CryptAcquireContextW
CryptHashData

Exports

Exports

SI02815e94e2c315f7
SI039413da2b10b773
SI054e3c8468772b2b
SI0628e029b7e108db
SI077534168313d3ed
SI0938f783b19237a0
SI0a886fd4c720116f
SI0bdc6d0c384d2e10
SI0ce1fad4c4f4a7fb
SI0cff507887d45bcd
SI0d6b1c4a8f9f99d4
SI0da8b85fb82501d5
SI11726a584883eb5b
SI13396627163b7740
SI157f8e08193aa53b
SI1773c1143669a2d4
SI179fdc030276548d
SI1d81196412d3ef05
SI1def9b218f2b4647
SI1e14e4ca4a95bf49
SI1f188bbd4af5db07
SI21a888837ee363be
SI2205f161df7092bc
SI23fce3fb79cbb177
SI24f086e117ed378d
SI255d44cceccc3fc7
SI2560e79b9e8e0efc
SI258150823cbe6bde
SI2711207af0065fc8
SI27b50b0098946eb0
SI28dd7560c8be508f
SI294b84466eaff39a
SI2a4d8b6ad44eebf1
SI2a62764d0ab77e14
SI2b645959c9369085
SI2d11646dfe5d0c6a
SI2eb4079ca3a05cbf
SI2f014207a555e535
SI33ef63550c5242fb
SI341218eede1b5e9b
SI37a08ac191c978d9
SI386737cd2a0fdd19
SI3997e7de4e90e1b3
SI3ae1edd0b6623730
SI3c17a08e4bd9b715
SI3ce20b46a489236f
SI3f6b70ecace50eb3
SI43bfa22e745af6d8
SI44d6ee46b9c95458
SI45fe9413d5eae770
SI473a804e6f038305
SI475081909f1229d5
SI47e966d3c8ed1d1c
SI486b02ac296e0b17
SI4b285cf3ba62c252
SI4ca8ca7236e6114c
SI4d5fafa34f690772
SI4edf79ad44a9cff4
SI4ee0a8e4fbaae675
SI506e50fb03c2d89a
SI528b790fd6ac4633
SI55f8c019b2e5ed58
SI56aabcf29f5e6720
SI56bf96ba405a1160
SI577edba978146092
SI57cb62b7ae61cb1b
SI599b44278adc9bc1
SI5b8ed01c5811b4d5
SI5bb9251d9841cbec
SI5ca7a2a9e7f1b871
SI5f6198a74f6a66c1
SI5f81f83484be3abd
SI5f8c56b9ec22dac6
SI609a818d5fbe9ac9
SI61339d837097a253
SI6199891c0152daea
SI61ebe33d35212c42
SI6527c62a1dabea11
SI66864656aba1350f
SI670f4f88bee34d06
SI690e97ad40a6d636
SI6986c52c0c452cc1
SI6b1ea8359a4bab8f
SI6c336868b0a5fe32
SI6d1c17b1fb262865
SI6d7b2699ee23d3f8
SI6e43416f0f0e0e16
SI72ec7143af42ede1
SI74043e952a2cd403
SI7520d000053e0d14
SI772bd4b1b0106e5b
SI782e3aea35580db5
SI7a5090ee686ee20d
SI7b32bbd817c65bb8
SI7ba05ce94ad6ec39
SI7c80035d85f12db7
SI7cec4139b0e05c44
SI7d59e220321e2f41
SI7d92c115a9fdcf4b
SI7e589f074eae40b8
SI7f61887459ad69d9
SI7fbe039e0a0a9e80
SI7fca2652f71267db
SI8181a48bde70c668
SI870da7e43adb4ee2
SI89eaf1bd7a956980
SI8a4e5681c1906ed7
SI8a4f24784a6e0dd7
SI9086cecb6f6cb06e
SI9142d5013e275b68
SI917c1d969e6de20e
SI92a9d705cf067ce9
SI95b0bda85d917b2e
SI962c27000aacea2e
SI98872790d4e8efd1
SI9a7f75f0346092f5
SI9a83e170c880ff66
SI9cb60bb60df261b3
SI9ce43ab9f0988669
SI9d59c342e257f634
SI9ee262799bd281d7
SI9eee50437bcc1191
SI9f7fed40b32f2518
SIa2d290f3cce83950
SIa3d8d3d7074939f8
SIa3f72e1fcd28493d
SIa487294f7b3982b5
SIa56f9b6b87626f82
SIa6ac334abbe174be
SIa6adfe554ffc7cbf
SIa97f15c7a9a3fcec
SIac17d6653268c29d
SIac40f022a187cea2
SIac721dd2e74c9941
SIafaf563ba75328fe
SIb01052dff9582bba
SIb3a01e7c57f0fe15
SIb3a698858b4f4c1e
SIb3adde975ae37b85
SIb4c632894b76cc1d
SIb534977cefbb73a0
SIb7ca6c18f9b627e3
SIb8b2ca972163fd1d
SIb90da090982f4b08
SIbadadf3b9880be1c
SIbae16952f377e56d
SIbaf8241fbd0ce62c
SIbbb652829bd5e949
SIbbe901f293754481
SIbbfce5c96068face
SIbcc66e0ffc3a4a1a
SIbf23d3c9d85dbdc9
SIc15bffd7e1940157
SIc28680a63df4f588
SIc2f1bb5274db50ad
SIc5e7050b98faec6c
SIc62437a375ae6e3e
SIc6bf4b86ca97d9ec
SIc6d60081c2db6a17
SIc8187efca8c1cb7a
SIcd04f8e391a31c9f
SIcdd4568419784a8a
SIcf8c2c23760a4499
SId02b7e5e97e1e93a
SId2c7880f24f06d7c
SId2c89445431c35db
SId644b1bddd2a2bbd
SId6fdbb9d0d4025e5
SId81be8ee89587e08
SId81cf9ee807123a7
SId8f3329973466732
SId8f792fefa4b5275
SId93ded5c6e4c47cf
SIdeafee00e45abdd7
SIdff2308d05ffee18
SIe1f990609c49e19e
SIe2c7699ad7342993
SIe43bdb992e04bab8
SIe51ef6b50d4bca6d
SIe8488cc730a7a082
SIea4bbb6d1ee2a307
SIea85a8543a7ed080
SIeab73374c21d5265
SIebbb430d08e906d0
SIee287d5c749c90fb
SIef4f0710e0d4fe79
SIefe0985609bde5e8
SIf17d2cb586e5ed0b
SIf317063645427306
SIf36d68994f8a3dbc
SIf55420fc5e7a71c7
SIf5788ad6b55cce99
SIf78f8f1191d53f8b
SIf7e752fd3d0936c7
SIfc766c3d655f3fe2
SIfd60417394c54f67
SIfdd143ea824fb4f0
SIff65f01991d44537
sqlite3_cryptoapi_init
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_percentile_init
sqlite3_regexp_init
sqlite3_sha_init
sqlite3_totype_init
sqlite3_vtshim_init

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 259KB - Virtual size: 259KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 22KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/x64/sqlite3.dll
.dll windows:5 windows x64 arch:x64

86407fa80eeaaabce41f53dc0aee34db

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\dev\sqlite\core\sqlite3.pdb

Imports

kernel32

FlushViewOfFile
GetProcessHeap
OutputDebugStringW
OutputDebugStringA
WaitForSingleObjectEx
WaitForSingleObject
WriteFile
WideCharToMultiByte
UnmapViewOfFile
UnlockFileEx
UnlockFile
SystemTimeToFileTime
Sleep
SetFilePointer
SetEndOfFile
ReadFile
QueryPerformanceCounter
MultiByteToWideChar
MapViewOfFile
LockFileEx
LockFile
LocalFree
LoadLibraryW
LoadLibraryA
HeapCompact
HeapValidate
HeapSize
HeapReAlloc
HeapFree
HeapDestroy
HeapCreate
HeapAlloc
GetVersionExW
GetVersionExA
GetTickCount
GetTempPathW
GetTempPathA
GetSystemTimeAsFileTime
GetSystemTime
GetSystemInfo
GetProcAddress
GetLastError
GetFullPathNameW
GetFullPathNameA
GetFileSize
GetFileAttributesExW
GetFileAttributesW
GetFileAttributesA
GetDiskFreeSpaceW
GetDiskFreeSpaceA
GetCurrentProcessId
FreeLibrary
FormatMessageW
FormatMessageA
FlushFileBuffers
DeleteFileW
DeleteFileA
CreateMutexW
CreateFileMappingW
CreateFileMappingA
CreateFileW
CreateFileA
CloseHandle
AreFileApisANSI
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
ExitThread
CreateThread
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetTimeZoneInformation
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameA
HeapSetInformation
EncodePointer
DecodePointer
TlsAlloc
FlsGetValue
FlsFree
SetLastError
GetCurrentThread
FlsAlloc
RtlUnwindEx
SetHandleCount
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
FatalAppExitA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetDateFormatA
GetTimeFormatA
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
RaiseException
CompareStringA
CompareStringW
SetEnvironmentVariableA

Exports

Exports

sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_bind_zeroblob64
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_data_directory
sqlite3_db_cacheflush
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_fts5_may_be_corrupt
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_msize
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_subtype
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_result_zeroblob64
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_status64
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_strglob
sqlite3_stricmp
sqlite3_strlike
sqlite3_strnicmp
sqlite3_system_errno
sqlite3_table_column_metadata
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_dup
sqlite3_value_free
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_subtype
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_config
sqlite3_vtab_on_conflict
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_mbcs_to_utf8_v2
sqlite3_win32_set_directory
sqlite3_win32_sleep
sqlite3_win32_unicode_to_utf8
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_utf8_to_mbcs_v2
sqlite3_win32_utf8_to_unicode
sqlite3_win32_write_debug

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 198KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/x86/NSecsoft.NativeModule.dll
.dll windows:5 windows x86 arch:x86

55d83c5347d113e22705d59d129dc276

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Client\Client-CommonLibs\NSecsoft.NativeModule\Release\x86\NSecsoft.NativeModule.pdb

Imports

kernel32

ResetEvent
SystemTimeToTzSpecificLocalTime
GetCurrentDirectoryW
DisableThreadLibraryCalls
GetLocalTime
GetFileTime
GetCurrentProcessId
FileTimeToLocalFileTime
CloseHandle
FileTimeToSystemTime
GetLastError
OpenProcess
CreateFileW
ReadFile
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
CreateDirectoryW
SetStdHandle
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FormatMessageW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
CreateMutexW
WaitForSingleObject
LocalFree
CreateProcessW
OpenMutexW
GetExitCodeProcess
GetLogicalDrives
HeapFree
GetDriveTypeA
GetVolumeInformationA
CreateFileA
HeapAlloc
SetFileAttributesA
GetComputerNameW
GetProcessHeap
GetPrivateProfileStringA
InterlockedDecrement
HeapSize
HeapReAlloc
RaiseException
HeapDestroy
QueryDosDeviceW
ReleaseMutex
DeleteFileW
MoveFileExW
SizeofResource
EnumResourceTypesW
WriteFile
EnumResourceNamesW
GetTempPathW
LockResource
LoadResource
FindResourceW
FreeLibrary
LoadLibraryExW
OpenFileMappingW
CreateFileMappingW
MapViewOfFile
SetFileAttributesW
Sleep
GetDriveTypeW
DeleteFileA
GetModuleFileNameW
GetModuleFileNameA
InitializeCriticalSection
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
GetSystemInfo
LoadLibraryW
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSize
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
SetEvent
FindFirstFileW
FindNextFileW
DeviceIoControl
FindClose
LocalAlloc
GetModuleHandleA
GetFileSizeEx
GetSystemDirectoryA
SetFilePointerEx
TerminateThread
QueueUserAPC
SleepEx
RtlUnwind
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
WriteConsoleW
CreateThread
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExA
FindNextFileA

user32

GetProcessWindowStation
MessageBoxW
GetUserObjectInformationW
FindWindowExA
GetWindowThreadProcessId
wsprintfA

advapi32

SetEntriesInAclW
AllocateAndInitializeSid
RegCloseKey
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
DuplicateTokenEx
SetThreadToken
OpenProcessToken
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
RegOpenKeyExW
InitializeSecurityDescriptor
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
LookupPrivilegeValueW
AdjustTokenPrivileges
SetFileSecurityW
ConvertSidToStringSidA
RegQueryValueExA
RegCreateKeyExW
RegSetValueExW
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExA

shell32

SHCreateDirectoryExW
SHCreateDirectoryExA
ShellExecuteExW
SHGetSpecialFolderPathW

shlwapi

StrToInt64ExA
PathFindFileNameW
StrToIntExA
PathFindFileNameA
wvnsprintfA
PathAppendW
PathFileExistsA
PathIsNetworkPathW
SHDeleteValueW
StrCpyW
wnsprintfA
PathFileExistsW
wnsprintfW
PathFindExtensionW
SHSetValueA
StrCmpIW
PathIsDirectoryW

iphlpapi

GetAdaptersAddresses

netapi32

Netbios

ws2_32

closesocket
WSAIoctl
bind
send
WSAEnumNetworkEvents
WSAEventSelect
getpeername
getsockname
WSACloseEvent
ntohs
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
recvfrom
sendto
WSACreateEvent
WSASetLastError
gethostname
inet_ntoa
gethostbyname
WSAGetLastError
setsockopt
htons
recv
connect
socket
inet_addr
getsockopt
ioctlsocket
getnameinfo
shutdown
freeaddrinfo

crypt32

CertGetNameStringW
CertFindCertificateInStore
CryptMsgGetParam
CertCloseStore
CryptQueryObject
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertFreeCertificateContext
CryptMsgClose
CertOpenStore
CertOpenSystemStoreW
CertGetIntendedKeyUsage
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage

wldap32

ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

ole32

CoUninitialize
CoCreateInstance
CoSetProxyBlanket
CoInitialize

oleaut32

SysAllocString
SysFreeString

Exports

Exports

DesDecryptFile
DesDtd
DesEncryptFile
DesGetFileMetaInfo
DesImportOfflinePolicy
DesIsFileEncrypted
DesRecordDecReason
DesRecordEnc
DesSetFileMetaInfo
FsGetFileTime2
GetConsoleServerHost
GetCurrentProcessUserSID
GetGlobalID
GetUid
GetUserSID
GetValueFromMMKV
GetValueFromMMKVEx
GetZenServerHost
ImageExtractFileIcon
ImpersonateExplorerToken
IsZipFile
PeGetFileDigitalSign2
PeGetFileInfo2
ReleaseValueFromMMKV
SeSetPrivilege
SetValueToMMKV
SetValueToMMKVEx
ShExcuteW2
xConfigDestroy
xConfigInit
xConfigSet

Sections

.text
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 500KB - Virtual size: 500KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 45KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/x86/SQLite.Interop.dll
.dll windows:6 windows x86 arch:x86

eb18b8a806c5ef4838a8b14d6a79765e

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

01/10/2021, 00:00

Not After

12/12/2024, 23:59

Subject

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:0c:c7:2c:cf:31:ae:9b:2e:36:41:0a:d0:ee:98:92
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

01/10/2021, 00:00

Not After

12/12/2024, 23:59

Subject

SERIALNUMBER=364617-96,CN=Mistachkin Systems (Joseph Mistachkin),O=Mistachkin Systems (Joseph Mistachkin),L=Beaverton,ST=Oregon,C=US,1.3.6.1.4.1.311.60.2.1.2=#13064f7265676f6e,1.3.6.1.4.1.311.60.2.1.3=#13025553,2.5.4.15=#130f427573696e65737320456e74697479

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:7a:4a:88:9e:c9:99:42:90:06:63:38:4d:86:97:9d
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

29/03/2022, 00:00

Not After

14/03/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fd:fc:ed:37:4e:24:b2:01:d8:22:4a:82:ca:db:65:67:9e:6a:52:d7:a0:52:04:cf:06:47:fc:d4:af:ac:72:81:66:77:4a:73:4a:ee:2d:e9:a3:b0:4d:16:f6:ed:69:41:1f:e2:42:fc:31:1f:c7:c1:0f:b1:20:9b:24:ae:8b:92
Signer

Actual PE Digest

fd:fc:ed:37:4e:24:b2:01:d8:22:4a:82:ca:db:65:67:9e:6a:52:d7:a0:52:04:cf:06:47:fc:d4:af:ac:72:81:66:77:4a:73:4a:ee:2d:e9:a3:b0:4d:16:f6:ed:69:41:1f:e2:42:fc:31:1f:c7:c1:0f:b1:20:9b:24:ae:8b:92

Digest Algorithm

sha512

PE Digest Matches

true

3a:38:35:76:9b:51:0a:0e:61:24:12:a2:7d:09:49:2e:3a:bc:f6:16
Signer

Actual PE Digest

3a:38:35:76:9b:51:0a:0e:61:24:12:a2:7d:09:49:2e:3a:bc:f6:16

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\dev\sqlite\dotnet-private\bin\2013\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb

Imports

mscoree

StrongNameSignatureVerificationEx
StrongNameFreeBuffer
StrongNameErrorInfo
CorBindToRuntimeEx
StrongNameTokenFromAssembly

wintrust

WinVerifyTrust

kernel32

GetEnvironmentVariableW
HeapReAlloc
CreateFileA
GetFileSize
CreateMutexW
HeapCompact
SetFilePointer
TryEnterCriticalSection
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
SetEnvironmentVariableW
QueryPerformanceCounter
HeapFree
WaitForSingleObject
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetModuleHandleW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
HeapDestroy
GetFileAttributesA
GetFullPathNameA
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
GetModuleFileNameW
CreateFileW
MultiByteToWideChar
lstrlenW
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
lstrcmpiW
lstrcatW
GetFileAttributesExW
DeleteCriticalSection
OutputDebugStringA
SetEnvironmentVariableA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
GetConsoleCP
LCMapStringW
GetFullPathNameW
GetConsoleMode
SetFilePointerEx
RtlUnwind
RaiseException
SetStdHandle
WriteConsoleW
LeaveCriticalSection
GetCurrentThreadId
EncodePointer
DecodePointer
CreateThread
ExitThread
LoadLibraryExW
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetTimeZoneInformation
SetLastError
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
ExitProcess
GetModuleHandleExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetStdHandle
GetFileType
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStringTypeW
CompareStringW

user32

wsprintfW

advapi32

CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptReleaseContext
CryptDeriveKey
CryptAcquireContextW
CryptHashData

Exports

Exports

SI02815e94e2c315f7
SI039413da2b10b773
SI054e3c8468772b2b
SI0628e029b7e108db
SI077534168313d3ed
SI0938f783b19237a0
SI0a886fd4c720116f
SI0bdc6d0c384d2e10
SI0cff507887d45bcd
SI0d6b1c4a8f9f99d4
SI0da8b85fb82501d5
SI11726a584883eb5b
SI13396627163b7740
SI157f8e08193aa53b
SI1773c1143669a2d4
SI179fdc030276548d
SI1d81196412d3ef05
SI1def9b218f2b4647
SI1e14e4ca4a95bf49
SI1f188bbd4af5db07
SI21a888837ee363be
SI23fce3fb79cbb177
SI24f086e117ed378d
SI255d44cceccc3fc7
SI2560e79b9e8e0efc
SI258150823cbe6bde
SI2711207af0065fc8
SI28dd7560c8be508f
SI294b84466eaff39a
SI2a62764d0ab77e14
SI2b645959c9369085
SI2d11646dfe5d0c6a
SI2eb4079ca3a05cbf
SI2f014207a555e535
SI33ef63550c5242fb
SI341218eede1b5e9b
SI386737cd2a0fdd19
SI3997e7de4e90e1b3
SI3c17a08e4bd9b715
SI3ce20b46a489236f
SI43bfa22e745af6d8
SI44d6ee46b9c95458
SI45fe9413d5eae770
SI475081909f1229d5
SI47e966d3c8ed1d1c
SI486b02ac296e0b17
SI528b790fd6ac4633
SI55f8c019b2e5ed58
SI56bf96ba405a1160
SI599b44278adc9bc1
SI5b8ed01c5811b4d5
SI5ca7a2a9e7f1b871
SI5f6198a74f6a66c1
SI5f81f83484be3abd
SI5f8c56b9ec22dac6
SI609a818d5fbe9ac9
SI61339d837097a253
SI6199891c0152daea
SI61ebe33d35212c42
SI66864656aba1350f
SI670f4f88bee34d06
SI690e97ad40a6d636
SI6986c52c0c452cc1
SI6b1ea8359a4bab8f
SI6c336868b0a5fe32
SI6d1c17b1fb262865
SI6d7b2699ee23d3f8
SI72ec7143af42ede1
SI74043e952a2cd403
SI7520d000053e0d14
SI7a5090ee686ee20d
SI7ba05ce94ad6ec39
SI7c80035d85f12db7
SI7cec4139b0e05c44
SI7d59e220321e2f41
SI7e589f074eae40b8
SI7f61887459ad69d9
SI7fbe039e0a0a9e80
SI7fca2652f71267db
SI8181a48bde70c668
SI870da7e43adb4ee2
SI89eaf1bd7a956980
SI8a4e5681c1906ed7
SI9086cecb6f6cb06e
SI9142d5013e275b68
SI92a9d705cf067ce9
SI95b0bda85d917b2e
SI962c27000aacea2e
SI98872790d4e8efd1
SI9a83e170c880ff66
SI9ce43ab9f0988669
SI9d59c342e257f634
SI9f7fed40b32f2518
SIa2d290f3cce83950
SIa3f72e1fcd28493d
SIa487294f7b3982b5
SIa56f9b6b87626f82
SIa6ac334abbe174be
SIa6adfe554ffc7cbf
SIa97f15c7a9a3fcec
SIac17d6653268c29d
SIb01052dff9582bba
SIb3a01e7c57f0fe15
SIb3a698858b4f4c1e
SIb3adde975ae37b85
SIb7ca6c18f9b627e3
SIb8b2ca972163fd1d
SIb90da090982f4b08
SIbadadf3b9880be1c
SIbae16952f377e56d
SIbaf8241fbd0ce62c
SIbbe901f293754481
SIbbfce5c96068face
SIbcc66e0ffc3a4a1a
SIbf23d3c9d85dbdc9
SIc15bffd7e1940157
SIc2f1bb5274db50ad
SIc5e7050b98faec6c
SIc6d60081c2db6a17
SIc8187efca8c1cb7a
SIcd04f8e391a31c9f
SIcdd4568419784a8a
SIcf8c2c23760a4499
SId2c7880f24f06d7c
SId2c89445431c35db
SId644b1bddd2a2bbd
SId6fdbb9d0d4025e5
SId81be8ee89587e08
SId81cf9ee807123a7
SId93ded5c6e4c47cf
SIdeafee00e45abdd7
SIdff2308d05ffee18
SIe1f990609c49e19e
SIea85a8543a7ed080
SIeab73374c21d5265
SIebbb430d08e906d0
SIee287d5c749c90fb
SIef4f0710e0d4fe79
SIf17d2cb586e5ed0b
SIf317063645427306
SIf36d68994f8a3dbc
SIf55420fc5e7a71c7
SIf5788ad6b55cce99
SIf78f8f1191d53f8b
SIf7e752fd3d0936c7
SIfc766c3d655f3fe2
SIfdd143ea824fb4f0
SIff65f01991d44537
_SI0ce1fad4c4f4a7fb@8
_SI2205f161df7092bc@12
_SI27b50b0098946eb0@12
_SI2a4d8b6ad44eebf1@12
_SI37a08ac191c978d9@12
_SI3ae1edd0b6623730@8
_SI3f6b70ecace50eb3@44
_SI473a804e6f038305@8
_SI4b285cf3ba62c252@4
_SI4ca8ca7236e6114c@4
_SI4d5fafa34f690772@8
_SI4edf79ad44a9cff4@24
_SI4ee0a8e4fbaae675@0
_SI506e50fb03c2d89a@12
_SI56aabcf29f5e6720@16
_SI577edba978146092@4
_SI57cb62b7ae61cb1b@12
_SI5bb9251d9841cbec@4
_SI6527c62a1dabea11@20
_SI6e43416f0f0e0e16@12
_SI772bd4b1b0106e5b@4
_SI782e3aea35580db5@12
_SI7b32bbd817c65bb8@0
_SI7d92c115a9fdcf4b@8
_SI8a4f24784a6e0dd7@4
_SI917c1d969e6de20e@12
_SI9a7f75f0346092f5@20
_SI9cb60bb60df261b3@32
_SI9ee262799bd281d7@4
_SI9eee50437bcc1191@12
_SIa3d8d3d7074939f8@12
_SIac40f022a187cea2@12
_SIac721dd2e74c9941@12
_SIafaf563ba75328fe@4
_SIb4c632894b76cc1d@20
_SIb534977cefbb73a0@12
_SIbbb652829bd5e949@112
_SIc28680a63df4f588@12
_SIc62437a375ae6e3e@8
_SIc6bf4b86ca97d9ec@4
_SId02b7e5e97e1e93a@8
_SId8f3329973466732@12
_SId8f792fefa4b5275@4
_SIe2c7699ad7342993@36
_SIe43bdb992e04bab8@8
_SIe51ef6b50d4bca6d@8
_SIe8488cc730a7a082@12
_SIea4bbb6d1ee2a307@8
_SIefe0985609bde5e8@12
_SIfd60417394c54f67@12
sqlite3_cryptoapi_init
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_percentile_init
sqlite3_regexp_init
sqlite3_sha_init
sqlite3_totype_init
sqlite3_vtshim_init

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 206KB - Virtual size: 205KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/x86/sqlite3.dll
.dll windows:4 windows x86 arch:x86

923aa130c21002b50b462e446b3be0d9

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

AreFileApisANSI
CloseHandle
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateMutexW
DeleteCriticalSection
DeleteFileA
DeleteFileW
EnterCriticalSection
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFullPathNameA
GetFullPathNameW
GetLastError
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetTempPathA
GetTempPathW
GetTickCount
GetVersionExA
GetVersionExW
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
HeapValidate
InitializeCriticalSection
InterlockedCompareExchange
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
LocalFree
LockFile
LockFileEx
MapViewOfFile
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
ReadFile
SetEndOfFile
SetFilePointer
SetUnhandledExceptionFilter
Sleep
SystemTimeToFileTime
TerminateProcess
TlsGetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnlockFile
UnlockFileEx
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte
WriteFile

msvcrt

__dllonexit
__setusermatherr
_amsg_exit
_beginthreadex
_endthreadex
_errno
_initterm
_iob
_lock
_onexit
localtime
calloc
fprintf
free
fwrite
malloc
memcmp
memmove
qsort
realloc
strcmp
strlen
strncmp
_unlock
abort
vfprintf

Exports

Exports

sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_bind_zeroblob64
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_data_directory
sqlite3_db_cacheflush
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_fts5_may_be_corrupt
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_msize
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare_v2
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_subtype
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_result_zeroblob64
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_status64
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_strglob
sqlite3_stricmp
sqlite3_strlike
sqlite3_strnicmp
sqlite3_system_errno
sqlite3_table_column_metadata
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_trace
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_dup
sqlite3_value_free
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_subtype
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_config
sqlite3_vtab_on_conflict
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_mbcs_to_utf8_v2
sqlite3_win32_set_directory
sqlite3_win32_sleep
sqlite3_win32_unicode_to_utf8
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_utf8_to_mbcs_v2
sqlite3_win32_utf8_to_unicode
sqlite3_win32_write_debug

Sections

.text
Size: 538KB - Virtual size: 538KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 1024B - Virtual size: 728B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 1024B - Virtual size: 617B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 1024B - Virtual size: 656B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Blazor.Reporting.v22.1.Viewer.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Blazor.RichEdit.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Blazor.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Charts.Designer.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Dashboard.v22.1.Core.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Dashboard.v22.1.Web.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Dashboard.v22.1.Win.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 159KB - Virtual size: 159KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Data.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.DataAccess.v22.1.UI.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.DataAccess.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Diagram.v22.1.Core.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Dialogs.v22.1.Core.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.EntityFrameworkCore.Security.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.AuditTrail.Xpo.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Blazor.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Chart.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.CloneObject.Xpo.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Dashboards.Web.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Dashboards.Win.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Dashboards.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.FileAttachment.Blazor.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.FileAttachment.Web.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.FileAttachment.Win.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.HtmlPropertyEditor.Win.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Kpi.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Maps.Web.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Notifications.Web.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Notifications.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Objects.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Office.Web.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Office.Win.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.PivotChart.Web.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.PivotChart.Win.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.PivotChart.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.PivotGrid.Web.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.PivotGrid.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Reports.Web.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Reports.Win.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Reports.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.ReportsV2.Blazor.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.ReportsV2.Web.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.ReportsV2.Win.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.ReportsV2.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Scheduler.Web.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Scheduler.Win.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Scheduler.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.ScriptRecorder.Win.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.ScriptRecorder.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Security.Xpo.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Security.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.StateMachine.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Validation.Win.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Validation.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.ViewVariantsModule.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Web.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Win.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Workflow.Win.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.Workflow.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ExpressApp.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Map.v22.1.Core.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Mvvm.v22.1.DataModel.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Office.v22.1.Core.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Pdf.v22.1.Core.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Persistent.Base.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.PivotGrid.v22.1.Core.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Printing.v22.1.Core.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.ReportServer.v22.1.Localization.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.RichEdit.v22.1.Core.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 182KB - Virtual size: 181KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Snap.v22.1.Core.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Snap.v22.1.Extensions.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Snap.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Sparkline.v22.1.Core.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Spreadsheet.v22.1.Core.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 582KB - Virtual size: 581KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Utils.v22.1.UI.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Utils.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Web.ASPxDiagram.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Web.ASPxGantt.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Web.ASPxHtmlEditor.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Web.ASPxRichEdit.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Web.ASPxScheduler.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Web.ASPxSpellChecker.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Web.ASPxSpreadsheet.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Web.ASPxTreeList.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Web.Resources.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Web.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.Charts.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.CodeView.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.Controls.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.Core.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.Docking.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.DocumentViewer.v22.1.Core.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.Gantt.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.Gauges.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.Grid.v22.1.Core.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.LayoutControl.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.NavBar.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.PdfViewer.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.Printing.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 35KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.PropertyGrid.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.ReportDesigner.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.Ribbon.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.RichEdit.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.Scheduler.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.Scheduling.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.SpellChecker.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpf.Spreadsheet.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.Xpo.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraBars.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraCharts.v22.1.Wizard.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraCharts.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 290KB - Virtual size: 290KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraEditors.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 70KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraGantt.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraGauges.v22.1.Core.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraGauges.v22.1.Presets.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraGrid.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraLayout.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraNavBar.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraPdfViewer.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraPivotGrid.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraPrinting.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraReports.v22.1.Extensions.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraReports.v22.1.Web.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraReports.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 162KB - Virtual size: 162KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraRichEdit.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraScheduler.v22.1.Core.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraScheduler.v22.1.Extensions.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 50KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraScheduler.v22.1.Reporting.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraScheduler.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraSpellChecker.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraSpreadsheet.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraTreeList.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraVerticalGrid.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NSecUI/zh-Hans/DevExpress.XtraWizard.v22.1.resources.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/NxFileViewerSln/App.nsi
plugins/NxFileViewerSln/icon.ico
plugins/NxFileViewerSln/splash.bmp
plugins/RD/MSLogonACL.exe
.exe windows:5 windows x86 arch:x86

8318f66ec9b3c4695fae7fb3294f5099

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:97:4d:45:a3:88:61:c1:5e:d3:f0:31:a1:70:4c:65
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

14/10/2019, 00:00

Not After

12/12/2020, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3c:83:2b:b0:46:e7:af:4d:85:56:b0:dd:39:0c:5a:e2:13:e6:34:8b:44:ec:8f:b0:e8:02:cd:d1:65:b7:fc:61
Signer

Actual PE Digest

3c:83:2b:b0:46:e7:af:4d:85:56:b0:dd:39:0c:5a:e2:13:e6:34:8b:44:ec:8f:b0:e8:02:cd:d1:65:b7:fc:61

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

netapi32

NetWkstaGetInfo
NetApiBufferFree

kernel32

GetComputerNameW
GetLastError
HeapAlloc
LocalFree
GetProcessHeap
HeapFree
SetEndOfFile
ReadFile
IsDebuggerPresent
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
GetCommandLineW
HeapSetInformation
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
DecodePointer
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThreadId
GetProcAddress
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
WriteConsoleW
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
Sleep
ExitProcess
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
MultiByteToWideChar
RaiseException
WriteFile
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
CloseHandle
CreateFileW
HeapReAlloc
LoadLibraryW
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
FlushFileBuffers
LCMapStringW
IsProcessorFeaturePresent
SetFilePointer
HeapSize
SetStdHandle

advapi32

GetSidSubAuthorityCount
LookupAccountNameW
RegCreateKeyExW
RegSetValueExW
InitializeAcl
AddAccessDeniedAce
AddAccessAllowedAce
GetLengthSid
CopySid
GetAclInformation
RegCloseKey
RegQueryValueExW
RegOpenKeyExW
GetSidSubAuthority
GetSidIdentifierAuthority
IsValidSid
LookupAccountSidW
GetAce

Sections

.text
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
plugins/RD/NSecRD.exe
.exe windows:5 windows x86 arch:x86

73c0eedca274502a155ae73169df9f5a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Release\Client\plugins\RD\NSecRD.pdb

Imports

ws2_32

gethostbyname
setsockopt
inet_ntoa
gethostname
htons
htonl
socket
getsockopt
WSAGetLastError
send
WSACleanup
__WSAFDIsSet
accept
bind
WSAIoctl
closesocket
select
recv
shutdown
listen
WSAStartup
getpeername
inet_addr
getsockname
connect

version

GetFileVersionInfoSizeA
VerQueryValueA
GetFileVersionInfoA

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock
ExpandEnvironmentStringsForUserA

kernel32

VirtualAllocEx
ReadProcessMemory
SetThreadExecutionState
VirtualFreeEx
TerminateThread
SizeofResource
FindResourceA
LockResource
LoadResource
CreateMutexA
ReleaseMutex
GetStdHandle
WriteConsoleA
FormatMessageA
OpenMutexW
AllocConsole
GlobalGetAtomNameA
GlobalDeleteAtom
GetModuleHandleW
GlobalAddAtomA
SetProcessShutdownParameters
GetVolumeInformationA
TlsSetValue
ReleaseSemaphore
SetThreadPriority
DuplicateHandle
GetCurrentThread
TlsAlloc
TlsGetValue
TlsFree
CreateSemaphoreA
lstrcatA
lstrcpyA
GetFullPathNameA
GetVersion
LocalFileTimeToFileTime
FileTimeToLocalFileTime
GetFileType
DosDateTimeToFileTime
InterlockedExchange
lstrcpynA
lstrcmpiA
GetLocaleInfoA
SetVolumeLabelA
GetLocalTime
GetComputerNameA
GetUserDefaultLCID
IsValidLocale
GetProcessHeap
LCMapStringW
CompareStringW
GetACP
ReadConsoleW
GetTimeZoneInformation
GetConsoleMode
GetConsoleCP
SetStdHandle
GetCPInfo
GetFullPathNameW
GetCurrentDirectoryW
GetCurrentDirectoryA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeLibraryAndExitThread
ExitThread
GetModuleHandleExW
ExitProcess
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
EncodePointer
RtlUnwind
SetFilePointerEx
TerminateProcess
DeleteFileW
GetFileAttributesExW
SetFileAttributesW
RemoveDirectoryW
OutputDebugStringW
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetStringTypeW
MoveFileExW
HeapReAlloc
WriteConsoleW
CreateDirectoryW
FindFirstFileExA
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
HeapSize
HeapAlloc
GetSystemInfo
GetSystemDirectoryA
lstrlenA
HeapFree
MapViewOfFile
OpenFileMappingA
UnmapViewOfFile
FreeLibrary
DeleteFileA
CreateDirectoryA
SystemTimeToFileTime
GetLogicalDriveStringsA
FileTimeToSystemTime
MoveFileExA
GetFileAttributesA
SetEndOfFile
SetFilePointer
SetErrorMode
SetFileTime
GetDriveTypeA
GetTempPathA
FindClose
FindNextFileA
FindFirstFileA
GetProcessTimes
GetSystemTimeAsFileTime
DeleteCriticalSection
InitializeCriticalSection
LeaveCriticalSection
GetSystemTime
FlushFileBuffers
GetCurrentProcess
EnterCriticalSection
GetVersionExA
SetEvent
GetLastError
OpenProcess
OpenEventW
OpenEventA
GlobalUnlock
WideCharToMultiByte
MoveFileA
GetExitCodeThread
GetFileTime
GetFileSize
CreateFileA
CompareFileTime
ResetEvent
ResumeThread
SetFileAttributesA
SetCurrentDirectoryA
GetEnvironmentVariableA
GetExitCodeProcess
WaitNamedPipeW
CreateEventA
GetCurrentProcessId
LoadLibraryW
Process32Next
lstrcatW
CreateToolhelp32Snapshot
GetSystemDirectoryW
CreateFileW
WaitForSingleObject
WaitForMultipleObjects
OutputDebugStringA
WriteFile
Process32First
ReadFile
SetLastError
VerifyVersionInfoW
VerSetConditionMask
CreateFileMappingA
WritePrivateProfileSectionA
GetPrivateProfileStringA
GetPrivateProfileIntA
GetPrivateProfileStructA
WritePrivateProfileStringA
WritePrivateProfileStructA
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
GlobalLock
GlobalFree
GlobalAlloc
GlobalSize
MultiByteToWideChar
CreateThread
CloseHandle
Sleep
GetProcAddress
LoadLibraryA
GetModuleHandleA
GetCurrentThreadId
GetModuleFileNameA
GetTickCount
WinExec
GetLocaleInfoW
EnumSystemLocalesW

user32

OemToCharA
wvsprintfA
GetProcessWindowStation
GetDlgItemInt
CharToOemA
CheckDlgButton
SetDlgItemInt
LoadMenuA
GetMenuItemID
TrackPopupMenu
GetSubMenu
SetMenuDefaultItem
DestroyMenu
RemoveMenu
EnableMenuItem
EnableWindow
VkKeyScanA
GetAsyncKeyState
MapVirtualKeyA
ToAscii
SendInput
DestroyWindow
SetClipboardViewer
GetClipboardOwner
WaitMessage
PostThreadMessageA
ChangeClipboardChain
SendNotifyMessageA
PeekMessageA
IsWindowVisible
FillRect
GetIconInfo
GetClassNameA
WindowFromPoint
DrawTextA
FindWindowExA
OpenDesktopA
EnumDesktopWindows
SetRect
DestroyIcon
IntersectRect
GetUpdateRect
DrawIconEx
BeginPaint
EndPaint
GetKeyboardState
PtInRect
SetActiveWindow
MessageBeep
FlashWindow
EnumDisplayDevicesA
ChangeDisplaySettingsExA
GetKeyState
keybd_event
EnumDisplaySettingsA
GetWindowRect
LoadStringA
ScreenToClient
EndDialog
GetScrollInfo
DialogBoxParamA
GetDlgItemTextA
SetWindowTextA
MoveWindow
SetFocus
SendDlgItemMessageA
SetDlgItemTextA
GetClientRect
GetDlgItem
SetForegroundWindow
InvalidateRect
GetCursorPos
ExitWindowsEx
GetWindowThreadProcessId
wsprintfA
SystemParametersInfoA
GetForegroundWindow
GetDesktopWindow
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
IsClipboardFormatAvailable
RegisterClipboardFormatA
PostMessageA
SendMessageA
mouse_event
FindWindowA
GetMessageA
LoadImageA
DispatchMessageA
GetUserObjectInformationA
LoadCursorA
SetWindowPos
GetSystemMetrics
SetThreadDesktop
GetThreadDesktop
ShowWindow
CloseDesktop
SetTimer
SetWindowLongA
GetWindowLongA
AdjustWindowRect
DefWindowProcA
IsRectEmpty
CreateWindowExA
OpenInputDesktop
TranslateMessage
LoadIconA
KillTimer
PostQuitMessage
RegisterClassExA
GetDC
ReleaseDC
RegisterWindowMessageA

gdi32

GetSystemPaletteEntries
SetRectRgn
OffsetRgn
CreateRectRgn
GetRegionData
PtInRegion
CombineRgn
GetRgnBox
PatBlt
StretchBlt
ExtEscape
GetClipBox
SetBkMode
CreateSolidBrush
CreateDCA
BitBlt
CreateCompatibleBitmap
SelectObject
CreateDIBSection
CreateCompatibleDC
GetDIBits
GetDeviceCaps
GetPixel
DeleteDC
DeleteObject
GetObjectA
CreateFontIndirectA
SetBkColor
CreatePalette
SelectPalette
SetTextColor
RealizePalette
GdiFlush
SetDIBColorTable
GetBitmapBits
GetStockObject

advapi32

FreeSid
EnumServicesStatusA
GetSecurityDescriptorDacl
GetSecurityDescriptorGroup
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
IsValidSid
IsValidSecurityDescriptor
SetKernelObjectSecurity
IsValidAcl
GetKernelObjectSecurity
GetSecurityDescriptorLength
GetUserNameA
LookupAccountSidA
RegCreateKeyA
GetSecurityDescriptorSacl
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityDescriptorSacl
InitializeSecurityDescriptor
CreateServiceA
QueryServiceStatus
RegDeleteKeyA
CloseServiceHandle
QueryServiceConfigA
OpenSCManagerA
OpenServiceA
CreateProcessAsUserA
RegCloseKey
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
OpenProcessToken
RegOpenKeyExA
RegDeleteValueA
ImpersonateLoggedOnUser
AllocateAndInitializeSid
EqualSid
RevertToSelf
DuplicateTokenEx
LookupPrivilegeValueA
SetTokenInformation
AdjustTokenPrivileges
DeleteService
GetTokenInformation

shell32

SHFileOperationA
Shell_NotifyIconA
SHGetMalloc
ShellExecuteExA
SHGetPathFromIDListA
ShellExecuteA
SHGetSpecialFolderLocation

ole32

CoCreateInstance
CoInitialize
CoUninitialize

shlwapi

wnsprintfA
SHSetValueA

imm32

ImmGetDefaultIMEWnd

Sections

.text
Size: 892KB - Virtual size: 892KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 372KB - Virtual size: 371KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 494KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 178KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/RD/authSSP.dll
.dll windows:5 windows x86 arch:x86

8309dac6585e9077db9e5d40fe7b3983

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:97:4d:45:a3:88:61:c1:5e:d3:f0:31:a1:70:4c:65
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

14/10/2019, 00:00

Not After

12/12/2020, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

53:d2:2f:8c:e7:68:da:61:8e:e5:08:c8:05:8b:52:29:77:f3:ee:79:fe:26:be:c3:89:95:03:b4:ef:d1:06:8e
Signer

Actual PE Digest

53:d2:2f:8c:e7:68:da:61:8e:e5:08:c8:05:8b:52:29:77:f3:ee:79:fe:26:be:c3:89:95:03:b4:ef:d1:06:8e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\plugins\RD\authSSP.pdb

Imports

comctl32

PropertySheetW

kernel32

LocalAlloc
LoadLibraryW
GetProcAddress
FreeLibrary
GetLocalTime
lstrcatW
GetModuleFileNameW
LocalFree
lstrlenW
GetVersionExW
GetLastError
GetCurrentProcess
GetProcessHeap
HeapAlloc
HeapFree
GetCurrentThread
CloseHandle
lstrcpyW
SetEnvironmentVariableA
MultiByteToWideChar
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
GetSystemTimeAsFileTime
GetCurrentThreadId
DecodePointer
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
RtlUnwind
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
IsProcessorFeaturePresent
WriteFile
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
DeleteCriticalSection
Sleep
ExitProcess
FatalAppExitA
RaiseException
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
LCMapStringW
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetFilePointer
SetStdHandle
FlushFileBuffers
WriteConsoleW
CreateFileW
HeapReAlloc
SetConsoleCtrlHandler
InterlockedExchange
HeapSize
GetTimeZoneInformation
CreateFileA
SetEndOfFile
ReadFile
CompareStringW
LoadLibraryA

user32

MessageBoxW

advapi32

GetTokenInformation
IsValidAcl
InitializeAcl
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
SetSecurityDescriptorGroup
MakeSelfRelativeSD
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetAclInformation
AllocateAndInitializeSid
RegOpenKeyExW
RegQueryValueExW
RegCreateKeyW
RegSetValueExW
RegCloseKey
ReportEventW
DeregisterEventSource
RegisterEventSourceW
AreAnyAccessesGranted
AccessCheck
OpenThreadToken
MapGenericMask
OpenProcessToken
LookupPrivilegeValueW
LookupAccountNameW

Exports

Exports

CUPSD
vncEditSecurity

Sections

.text
Size: 138KB - Virtual size: 138KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/RD/authadmin.dll
.dll windows:5 windows x86 arch:x86

0ec295e6451db3ac014343423549eb14

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:97:4d:45:a3:88:61:c1:5e:d3:f0:31:a1:70:4c:65
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

14/10/2019, 00:00

Not After

12/12/2020, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

55:fb:f6:81:2c:be:93:fe:0d:80:9e:34:d1:22:73:61:ab:61:91:39:64:cd:bf:8b:2b:46:16:97:11:d2:84:8f
Signer

Actual PE Digest

55:fb:f6:81:2c:be:93:fe:0d:80:9e:34:d1:22:73:61:ab:61:91:39:64:cd:bf:8b:2b:46:16:97:11:d2:84:8f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\plugins\RD\authadmin.pdb

Imports

kernel32

CloseHandle
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
CreateFileW
GetLastError
WideCharToMultiByte
GetCurrentThreadId
DecodePointer
GetCommandLineA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThread
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
TerminateProcess
GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
HeapFree
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LCMapStringW
MultiByteToWideChar
GetStringTypeW
FatalAppExitA
RtlUnwind
HeapAlloc
HeapReAlloc
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryW
GetLocaleInfoW
WriteFile
GetModuleFileNameW
IsProcessorFeaturePresent
GetConsoleCP
GetConsoleMode
FlushFileBuffers
SetFilePointer
HeapSize
WriteConsoleW
SetStdHandle
IsValidLocale

advapi32

LogonUserA
CloseServiceHandle
OpenSCManagerA
RevertToSelf
ImpersonateLoggedOnUser

netapi32

NetApiBufferFree
NetWkstaGetInfo
NetGetDCName

Exports

Exports

CUGP

Sections

.text
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/RD/ldapauth.dll
.dll windows:5 windows x86 arch:x86

902a55c162fcc3a0025c09edf13b4ca8

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:97:4d:45:a3:88:61:c1:5e:d3:f0:31:a1:70:4c:65
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

14/10/2019, 00:00

Not After

12/12/2020, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

00:06:c0:74:bb:08:ef:6e:d8:8a:1d:88:48:6b:f2:b5:19:35:a9:77:1b:26:50:d6:7a:87:c6:4b:e7:d1:8c:cf
Signer

Actual PE Digest

00:06:c0:74:bb:08:ef:6e:d8:8a:1d:88:48:6b:f2:b5:19:35:a9:77:1b:26:50:d6:7a:87:c6:4b:e7:d1:8c:cf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\plugins\RD\ldapauth.pdb

Imports

activeds

ord3
ord6
ord9

kernel32

GetVersionExW
SetStdHandle
WriteConsoleW
CloseHandle
SetFilePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
LoadLibraryW
GetLastError
MultiByteToWideChar
GetCurrentThreadId
DecodePointer
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
GetCurrentProcess
HeapAlloc
RaiseException
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThread
GetProcAddress
IsProcessorFeaturePresent
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FatalAppExitA
RtlUnwind
HeapSize
WriteFile
GetModuleFileNameW
LCMapStringW
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
CreateFileW

user32

wsprintfW

ole32

StringFromGUID2

oleaut32

VariantClear
SysFreeString
SysAllocString

Exports

Exports

CUGP

Sections

.text
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/RD/ldapauth9x.dll
.dll windows:5 windows x86 arch:x86

c40562f3b332bf73d04e767d2a0996f3

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:97:4d:45:a3:88:61:c1:5e:d3:f0:31:a1:70:4c:65
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

14/10/2019, 00:00

Not After

12/12/2020, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

af:59:4e:fa:e8:f2:ba:bf:a6:26:9d:84:25:5a:b1:54:ef:bc:c3:17:60:11:f6:b9:1e:75:ce:5d:59:61:61:dc
Signer

Actual PE Digest

af:59:4e:fa:e8:f2:ba:bf:a6:26:9d:84:25:5a:b1:54:ef:bc:c3:17:60:11:f6:b9:1e:75:ce:5d:59:61:61:dc

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\plugins\RD\ldapauth9x.pdb

Imports

activeds

ord3
ord6
ord9

kernel32

GetVersionExW
SetStdHandle
WriteConsoleW
CloseHandle
SetFilePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
GetLastError
MultiByteToWideChar
GetCurrentThreadId
DecodePointer
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
GetCurrentProcess
HeapAlloc
RaiseException
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThread
GetProcAddress
IsProcessorFeaturePresent
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FatalAppExitA
RtlUnwind
HeapSize
WriteFile
GetModuleFileNameW
LCMapStringW
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryW
CreateFileW

user32

wsprintfW

ole32

StringFromGUID2

oleaut32

SysAllocString
SysFreeString

Exports

Exports

CUGP

Sections

.text
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/RD/ldapauthnt4.dll
.dll windows:5 windows x86 arch:x86

a87024187e6053bbc1f8aa6b60052028

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:97:4d:45:a3:88:61:c1:5e:d3:f0:31:a1:70:4c:65
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

14/10/2019, 00:00

Not After

12/12/2020, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6b:0c:65:5d:44:a2:f1:dd:8c:5e:92:ba:1b:8a:7f:a8:f5:fc:a3:08:37:6f:38:49:8b:14:78:57:c8:8d:b7:ab
Signer

Actual PE Digest

6b:0c:65:5d:44:a2:f1:dd:8c:5e:92:ba:1b:8a:7f:a8:f5:fc:a3:08:37:6f:38:49:8b:14:78:57:c8:8d:b7:ab

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\plugins\RD\ldapauthnt4.pdb

Imports

activeds

ord3
ord6
ord9

netapi32

DsGetDcNameW

user32

wsprintfW

ole32

StringFromGUID2

oleaut32

SysAllocString
SysFreeString
VariantClear

kernel32

CreateFileW
SetStdHandle
WriteConsoleW
CloseHandle
SetFilePointer
FlushFileBuffers
GetConsoleMode
GetConsoleCP
LoadLibraryW
InterlockedExchange
GetLastError
MultiByteToWideChar
GetCurrentThreadId
DecodePointer
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
GetCurrentProcess
HeapAlloc
RaiseException
HeapFree
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
SetLastError
GetCurrentThread
GetProcAddress
IsProcessorFeaturePresent
Sleep
ExitProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FatalAppExitA
RtlUnwind
HeapSize
WriteFile
GetModuleFileNameW
LCMapStringW
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoW
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
SetConsoleCtrlHandler
FreeLibrary

Exports

Exports

CUGP

Sections

.text
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/RD/logging.dll
.dll windows:5 windows x86 arch:x86

3207188453ab0339dc6875d58718cc4f

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:97:4d:45:a3:88:61:c1:5e:d3:f0:31:a1:70:4c:65
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

14/10/2019, 00:00

Not After

12/12/2020, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cc:19:5e:90:0a:c7:cf:5f:cc:5b:3d:1f:fb:d6:df:b4:1d:e1:9a:d8:7f:e8:6f:a4:64:3a:d6:63:92:93:13:2d
Signer

Actual PE Digest

cc:19:5e:90:0a:c7:cf:5f:cc:5b:3d:1f:fb:d6:df:b4:1d:e1:9a:d8:7f:e8:6f:a4:64:3a:d6:63:92:93:13:2d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\plugins\RD\logging.pdb

Imports

kernel32

GetLocalTime
lstrcatA
GetModuleFileNameA
lstrcpyA
lstrlenA
GetCurrentThreadId
DecodePointer
GetCommandLineA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
TerminateProcess
GetCurrentProcess
GetLastError
HeapFree
IsProcessorFeaturePresent
CloseHandle
EnterCriticalSection
LeaveCriticalSection
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
InitializeCriticalSectionAndSpinCount
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
InterlockedDecrement
GetCurrentThread
GetProcAddress
Sleep
ExitProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
DeleteCriticalSection
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
FatalAppExitA
HeapAlloc
SetStdHandle
FlushFileBuffers
SetFilePointer
WriteConsoleW
MultiByteToWideChar
CreateFileA
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapReAlloc
SetConsoleCtrlHandler
FreeLibrary
InterlockedExchange
LoadLibraryW
GetLocaleInfoW
GetModuleFileNameW
CreateFileW
GetStringTypeW
SetEndOfFile
GetProcessHeap
ReadFile
LCMapStringW
HeapSize
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale

advapi32

RegisterEventSourceA
RegCreateKeyA
RegSetValueExA
RegCloseKey
ReportEventA
DeregisterEventSource

Exports

Exports

LOGEXIT
LOGFAILED
LOGFAILEDUSER
LOGLOGON
LOGLOGONUSER

Sections

.text
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/RD/setcad.exe
.exe windows:5 windows x86 arch:x86

69fda895686ad105accf11d70540b223

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:97:4d:45:a3:88:61:c1:5e:d3:f0:31:a1:70:4c:65
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

14/10/2019, 00:00

Not After

12/12/2020, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:02:ea:76:87:08:b0:3d:c6:12:3b:67:66:d6:26:14:29:ce:d9:aa:6a:93:89:c4:21:c5:7c:61:25:62:fd:50
Signer

Actual PE Digest

90:02:ea:76:87:08:b0:3d:c6:12:3b:67:66:d6:26:14:29:ce:d9:aa:6a:93:89:c4:21:c5:7c:61:25:62:fd:50

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\plugins\RD\setcad.pdb

Imports

advapi32

RegOpenKeyExW
RegCloseKey
RegSetValueExW
RegCreateKeyExW

kernel32

GetCommandLineW
HeapSetInformation
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetProcAddress
GetModuleHandleW
ExitProcess
DecodePointer
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
HeapFree
Sleep
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
RtlUnwind
WideCharToMultiByte
HeapSize
HeapAlloc
HeapReAlloc
IsProcessorFeaturePresent
LCMapStringW
MultiByteToWideChar
GetStringTypeW

Sections

.text
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/RD/setpasswd.exe
.exe windows:5 windows x86 arch:x86

198f56053aef4db7da97350b8e7e5278

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:97:4d:45:a3:88:61:c1:5e:d3:f0:31:a1:70:4c:65
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

14/10/2019, 00:00

Not After

12/12/2020, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:0a:43:a1:ef:84:7b:92:73:78:5b:71:f8:31:08:26:a7:fb:61:ef:4c:9a:b7:08:06:ef:44:ed:8e:b1:ba:da
Signer

Actual PE Digest

16:0a:43:a1:ef:84:7b:92:73:78:5b:71:f8:31:08:26:a7:fb:61:ef:4c:9a:b7:08:06:ef:44:ed:8e:b1:ba:da

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\plugins\RD\setpasswd.pdb

Imports

kernel32

WritePrivateProfileStructA
GetPrivateProfileStructA
GetModuleFileNameA
HeapReAlloc
HeapAlloc
GetSystemTimeAsFileTime
GetCommandLineA
HeapSetInformation
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
GetModuleHandleW
SetLastError
GetCurrentThreadId
GetLastError
InterlockedDecrement
GetProcAddress
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
LeaveCriticalSection
EnterCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
HeapFree
Sleep
LoadLibraryW
RtlUnwind
IsProcessorFeaturePresent
LCMapStringW
MultiByteToWideChar
GetStringTypeW
HeapSize

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/RD/testauth.exe
.exe windows:5 windows x86 arch:x86

e0f0094509996cc100972de016ced494

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:97:4d:45:a3:88:61:c1:5e:d3:f0:31:a1:70:4c:65
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

14/10/2019, 00:00

Not After

12/12/2020, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c3:75:4e:ad:17:4a:bb:7a:ce:9e:6b:cb:e1:ea:43:f5:78:6d:cb:4c:a8:d2:c1:5c:05:ca:60:2c:59:8e:53:4e
Signer

Actual PE Digest

c3:75:4e:ad:17:4a:bb:7a:ce:9e:6b:cb:e1:ea:43:f5:78:6d:cb:4c:a8:d2:c1:5c:05:ca:60:2c:59:8e:53:4e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
LoadLibraryA
GetProcAddress
GetVersionExA
WriteConsoleW
CloseHandle
HeapSize
EnterCriticalSection
LeaveCriticalSection
GetCommandLineA
HeapSetInformation
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
DecodePointer
TerminateProcess
GetCurrentProcess
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
Sleep
GetLastError
HeapFree
GetModuleHandleW
ExitProcess
WriteFile
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
MultiByteToWideChar
ReadFile
RtlUnwind
HeapAlloc
HeapReAlloc
LoadLibraryW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
IsProcessorFeaturePresent
LCMapStringW
GetStringTypeW
SetFilePointer
SetStdHandle
CreateFileW

ole32

CoUninitialize
CoInitialize

Sections

.text
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
plugins/RD/uvnc_settings.exe
.exe windows:5 windows x86 arch:x86

f480c2bb92cf824275c5804a6d309bf9

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:97:4d:45:a3:88:61:c1:5e:d3:f0:31:a1:70:4c:65
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

14/10/2019, 00:00

Not After

12/12/2020, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2a:5e:a6:e1:21:7f:dc:1d:88:34:45:07:02:4d:1d:6f:92:17:db:be:74:98:38:c1:4f:14:74:87:5d:1e:bc:12
Signer

Actual PE Digest

2a:5e:a6:e1:21:7f:dc:1d:88:34:45:07:02:4d:1d:6f:92:17:db:be:74:98:38:c1:4f:14:74:87:5d:1e:bc:12

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\plugins\RD\uvnc_settings.pdb

Imports

comctl32

InitCommonControlsEx
ord17

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

kernel32

GetPrivateProfileStringA
GetPrivateProfileStructA
WritePrivateProfileStructA
InterlockedDecrement
CreateThread
SetCurrentDirectoryA
GetFileAttributesA
GetLastError
Sleep
WinExec
InterlockedIncrement
LocalFree
FormatMessageA
lstrlenA
LocalAlloc
GetVersionExA
FlushFileBuffers
CloseHandle
CreateFileW
IsProcessorFeaturePresent
WriteConsoleW
SetStdHandle
HeapReAlloc
LoadLibraryW
RtlUnwind
GetPrivateProfileIntA
GetStringTypeW
MultiByteToWideChar
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
GetConsoleMode
GetConsoleCP
SetFilePointer
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DeleteCriticalSection
GetFileType
WritePrivateProfileStringA
WaitForSingleObject
CreateEventA
DeleteFileA
FreeLibrary
GetProcAddress
LoadLibraryA
FindClose
FindNextFileA
FindFirstFileA
GetModuleFileNameA
SetLastError
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
SetHandleCount
GetEnvironmentStringsW
GetModuleHandleW
WideCharToMultiByte
FreeEnvironmentStringsW
HeapSize
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
ExitProcess
HeapCreate
GetModuleFileNameW
GetStdHandle
HeapAlloc
HeapFree
EncodePointer
DecodePointer
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RaiseException
GetCPInfo
GetACP
WriteFile

user32

GetWindowRect
ShowWindow
MoveWindow
EnableWindow
SendMessageA
ScreenToClient
SetWindowTextA
MessageBoxA
SetForegroundWindow
SetWindowLongA
GetWindowLongA
EnumDisplaySettingsA
SetFocus
DestroyWindow
SetWindowPos
MapWindowPoints
CreateDialogParamA
LoadStringA
DialogBoxParamA
SetTimer
SetDlgItemInt
IsDlgButtonChecked
CheckDlgButton
wsprintfA
GetDlgItemTextA
SetDlgItemTextA
EndDialog
GetDlgItemInt
SendDlgItemMessageA
GetDesktopWindow
GetDlgItem

gdi32

DeleteDC
CreateDCA

advapi32

RegCreateKeyExA
QueryServiceStatus
CloseServiceHandle
OpenSCManagerA
QueryServiceStatusEx
DeleteService
CreateServiceA
RegCloseKey
RegSetValueExA
StartServiceA
OpenServiceA

shell32

ShellExecuteA

ole32

CoInitializeEx
CoUninitialize
CoInitialize
CoInitializeSecurity
CoCreateInstance

oleaut32

SysStringByteLen
SysAllocStringByteLen
SysFreeString
VariantClear
VariantInit
SysAllocString

iphlpapi

GetAdaptersInfo

ws2_32

WSACleanup
WSAStartup

Sections

.text
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 189KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
plugins/RD/uvnckeyboardhelper.exe
.exe windows:5 windows x86 arch:x86

73297fea4486a04032cf124403ba92c0

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:97:4d:45:a3:88:61:c1:5e:d3:f0:31:a1:70:4c:65
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

14/10/2019, 00:00

Not After

12/12/2020, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

03:19:11:8c:28:42:5d:3f:b5:07:a0:1b:ae:9a:2c:30:77:6c:fd:b0:7d:26:5f:f0:26:e7:d2:3f:65:54:a4:90
Signer

Actual PE Digest

03:19:11:8c:28:42:5d:3f:b5:07:a0:1b:ae:9a:2c:30:77:6c:fd:b0:7d:26:5f:f0:26:e7:d2:3f:65:54:a4:90

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\plugins\RD\uvnckeyboardhelper.pdb

Imports

kernel32

MapViewOfFile
OpenFileMappingA
OpenEventA
ResetEvent
EnterCriticalSection
SetEvent
WaitForSingleObject
LeaveCriticalSection
WaitForMultipleObjects
CreateThread
HeapReAlloc
GetStringTypeW
MultiByteToWideChar
LCMapStringW
GetLastError
DeleteCriticalSection
UnmapViewOfFile
CloseHandle
GetCurrentThreadId
InitializeCriticalSection
GetCommandLineA
HeapSetInformation
GetStartupInfoW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
HeapFree
EncodePointer
DecodePointer
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleFileNameA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
HeapCreate
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapAlloc
RtlUnwind
LoadLibraryW
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
Sleep
IsProcessorFeaturePresent
HeapSize

user32

SetThreadDesktop
CloseDesktop
GetUserObjectInformationA
GetThreadDesktop
OpenInputDesktop
keybd_event

advapi32

GetSecurityDescriptorSacl
ConvertStringSecurityDescriptorToSecurityDescriptorA
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetSecurityDescriptorSacl

Sections

.text
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 343KB - Virtual size: 342KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/RD/vnchooks.dll
.dll windows:5 windows x86 arch:x86

b57ea5a65cdbc435edc514ae3f1df7ca

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:97:4d:45:a3:88:61:c1:5e:d3:f0:31:a1:70:4c:65
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

14/10/2019, 00:00

Not After

12/12/2020, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8f:76:40:a2:66:4c:b6:62:f4:32:dc:86:92:c4:4b:79:c9:6a:ec:df:e6:53:77:74:50:f4:f3:97:2a:26:ab:8e
Signer

Actual PE Digest

8f:76:40:a2:66:4c:b6:62:f4:32:dc:86:92:c4:4b:79:c9:6a:ec:df:e6:53:77:74:50:f4:f3:97:2a:26:ab:8e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\plugins\RD\vnchooks.pdb

Imports

kernel32

GetStringTypeW
MultiByteToWideChar
LCMapStringW
HeapSize
IsProcessorFeaturePresent
HeapReAlloc
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RaiseException
LoadLibraryW
Sleep
CreateFileMappingA
UnmapViewOfFile
MapViewOfFile
CloseHandle
GlobalDeleteAtom
GlobalAddAtomA
GetModuleHandleA
RtlUnwind
GetModuleFileNameA
GetLastError
HeapFree
HeapAlloc
GetCurrentThreadId
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
EncodePointer
HeapCreate
HeapDestroy
GetProcAddress
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
GetModuleFileNameW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
InterlockedDecrement
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
LeaveCriticalSection
EnterCriticalSection

user32

RegisterWindowMessageA
GetUpdateRgn
GetPropA
SetPropA
FindWindowA
EnumWindows
SetWindowsHookExA
UnhookWindowsHookEx
CallNextHookEx
GetCursor
IsWindowVisible
GetWindowRect
PostMessageA
PostThreadMessageA
GetClientRect
ClientToScreen
RemovePropA

gdi32

GetRegionData
DeleteObject
CreateRectRgn

advapi32

RegQueryValueExA
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
RegSetValueExA

Exports

Exports

HooksType
SetHooks
SetKeyboardFilterHook
SetMouseFilterHook
UnSetHooks

Sections

.text
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/RD/workgrpdomnt4.dll
.dll windows:5 windows x86 arch:x86

c13b42306ca4346ef56bf678970ff101

Code Sign

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

Issuer

CN=Thawte Premium Server CA,OU=Certification Services Division,O=Thawte Consulting cc,L=Cape Town,ST=Western Cape,C=ZA,1.2.840.113549.1.9.1=#0c197072656d69756d2d736572766572407468617774652e636f6d

Not Before

17/11/2006, 00:00

Not After

30/12/2020, 23:59

Subject

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:a0:b7:36:95:dd:b1:af:c2:3b:2b:9a:18:ee:54:cb
Certificate

Issuer

CN=thawte Primary Root CA,OU=Certification Services Division+OU=(c) 2006 thawte\, Inc. - For authorized use only,O=thawte\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0c:97:4d:45:a3:88:61:c1:5e:d3:f0:31:a1:70:4c:65
Certificate

Issuer

CN=thawte SHA256 Code Signing CA,O=thawte\, Inc.,C=US

Not Before

14/10/2019, 00:00

Not After

12/12/2020, 23:59

Subject

CN=Shandong Anzai Information Technology CO.\,Ltd.,OU=Development,O=Shandong Anzai Information Technology CO.\,Ltd.,L=Jinan,ST=Shandong,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5c:bc:18:34:fe:fc:7d:51:00:88:65:2e:fb:56:a3:e0:f3:77:94:ff:d8:5b:df:b7:e9:3a:f2:9a:59:5b:b4:90
Signer

Actual PE Digest

5c:bc:18:34:fe:fc:7d:51:00:88:65:2e:fb:56:a3:e0:f3:77:94:ff:d8:5b:df:b7:e9:3a:f2:9a:59:5b:b4:90

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\plugins\RD\workgrpdomnt4.pdb

Imports

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
lstrcpyA
GetVersionExA
HeapFree
lstrlenA
HeapAlloc
GetProcessHeap
GetLastError
EnterCriticalSection
LeaveCriticalSection
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
DecodePointer
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlUnwind
SetHandleCount
GetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
GetStartupInfoW
DeleteCriticalSection
EncodePointer
Sleep
GetModuleHandleW
ExitProcess
FatalAppExitA
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThread
LCMapStringW
IsProcessorFeaturePresent
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
HeapReAlloc
SetConsoleCtrlHandler
InterlockedExchange
LoadLibraryW
GetLocaleInfoW
WriteFile
GetModuleFileNameW
GetConsoleCP
GetConsoleMode
FlushFileBuffers
GetStringTypeW
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
SetFilePointer
HeapSize
CloseHandle
WriteConsoleW
SetStdHandle
CreateFileW

Exports

Exports

CUGP

Sections

.text
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/RF/MasterRD.dll
.dll windows:4 windows x86 arch:x86

338ec110f140e8b987312ac0fd723138

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a6:a2:52:79:3d:51:2d:31:eb:8d:2b:3f:17:a5:7e:6a:4e:43:97:17:c8:59:5b:19:58:d4:c2:e8:da:0b:2d:90
Signer

Actual PE Digest

a6:a2:52:79:3d:51:2d:31:eb:8d:2b:3f:17:a5:7e:6a:4e:43:97:17:c8:59:5b:19:58:d4:c2:e8:da:0b:2d:90

Digest Algorithm

sha256

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

WriteFile
GetLastError
CreateFileA
CloseHandle
Sleep
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
HeapFree
HeapAlloc
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
HeapReAlloc
HeapSize
GetModuleHandleA
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
WideCharToMultiByte
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetFilePointer
InterlockedDecrement
InterlockedIncrement
GetStringTypeA
GetStringTypeW
GetProcAddress
LoadLibraryA
SetStdHandle
FlushFileBuffers

advapi32

RegCloseKey
RegOpenKeyExA
RegEnumKeyA

hid

HidP_GetCaps
HidD_GetFeature
HidD_SetFeature
HidD_GetPreparsedData
HidD_GetAttributes
HidD_FreePreparsedData
HidP_GetSpecificValueCaps

Exports

Exports

AT1608_Auth
AT1608_Authenticate
AT1608_CloseCard
AT1608_OpenCard
AT1608_Read
AT1608_ReadAAC
AT1608_ReadAR
AT1608_ReadATR
AT1608_ReadCMC
AT1608_ReadChar
AT1608_ReadCi
AT1608_ReadFC
AT1608_ReadFuse
AT1608_ReadFuse1
AT1608_ReadGc
AT1608_ReadLHC
AT1608_ReadMTZ
AT1608_ReadNc
AT1608_ReadPAC
AT1608_ReadPWD
AT1608_ReadValue
AT1608_Rst
AT1608_VerifyPWD
AT1608_VerifyPassword
AT1608_Write
AT1608_WriteAAC
AT1608_WriteAR
AT1608_WriteCMC
AT1608_WriteChar
AT1608_WriteCi
AT1608_WriteFuse
AT1608_WriteFuse1
AT1608_WriteGc
AT1608_WriteMTZ
AT1608_WriteNc
AT1608_WritePAC
AT1608_WritePWD
AT1608_WriteValue
AT24C_CloseCard
AT24C_OpenCard
AT24C_ReadChar
AT24C_ReadValue
AT24C_WriteChar
AT24C_WriteValue
AT24_read
AT24_write
AutoTestCard
CloseCard
DisPlayString
DisPlayTime
ISO15693_Get_Block_Security
ISO15693_Get_System_Information
ISO15693_Inventory
ISO15693_Inventorys
ISO15693_Lock_AFI
ISO15693_Lock_Block
ISO15693_Lock_DSFID
ISO15693_Read
ISO15693_Reset_To_Ready
ISO15693_Select
ISO15693_Stay_Quiet
ISO15693_Write
ISO15693_Write_AFI
ISO15693_Write_DSFID
MCS_ExitComm
MCS_GetStringMode
MCS_InitComm
MCS_LED
MCS_SetStringMode
MCS_TestDevice
MCS_TestDoor
OpenCard
ReadTime
SCHelp_BytesToHexString
SCHelp_HexStringToBytes
Srf55vp_Read
Srf55vp_Write
Srf55vp_WriteByte
Srf55vp_Write_Reread
WriteTime
des_decrypt
des_encrypt
lib_ver
rf_ClosePort
rf_DESFire_rst
rf_GetErrorMessage
rf_M1_authentication1
rf_M1_authentication2
rf_M1_decrement
rf_M1_increment
rf_M1_initval
rf_M1_read
rf_M1_readval
rf_M1_restore
rf_M1_transfer
rf_M1_write
rf_Shc1102_Auth
rf_Shc1102_Read
rf_Shc1102_Write
rf_antenna_sta
rf_anticoll
rf_at020_check
rf_at020_count
rf_at020_deselect
rf_at020_lock
rf_at020_read
rf_at020_write
rf_atqb
rf_attrib
rf_beep
rf_cl_deselect
rf_cos_command
rf_download_key
rf_free
rf_get_device_number
rf_get_model
rf_get_snr
rf_halt
rf_hltb
rf_init_com
rf_init_device_number
rf_init_sam
rf_init_type
rf_light
rf_read_e2_e
rf_receive
rf_request
rf_sam_cos
rf_sam_rst
rf_select
rf_sr176_protectblock
rf_sr176_readblock
rf_sr176_writeblock
rf_srix4k_authenticate
rf_srix4k_getuid
rf_srix4k_readblock
rf_srix4k_writeblock
rf_srix4k_writelockreg
rf_st_completion
rf_st_select
rf_thr1064_check
rf_thr1064_read
rf_thr1064_write
rf_transceive
rf_typea_rst
rf_typeb_cos
rf_ul_select
rf_ul_write
rf_write_e2_e
smartcard_cos
smartcard_rst

Sections

.text
Size: 36KB - Virtual size: 33KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ShareDa
Size: 4KB - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/RF/RFTools.exe
.exe windows:5 windows x86 arch:x86

c08073cbf5162b7ed28c95b0352a5dd9

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7e:aa:05:bc:c6:15:ea:2b:80:2c:56:b2:8e:42:df:51:80:32:7d:ac:09:7a:44:fa:5c:0e:c7:4c:a1:22:29:8c
Signer

Actual PE Digest

7e:aa:05:bc:c6:15:ea:2b:80:2c:56:b2:8e:42:df:51:80:32:7d:ac:09:7a:44:fa:5c:0e:c7:4c:a1:22:29:8c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\Nsec\Release\Client\RFTools.pdb

Imports

kernel32

GetModuleFileNameA
LoadLibraryA
GetProcAddress
HeapSize
GetLastError
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
FreeLibrary
LoadLibraryExW
GetStdHandle
GetFileType
GetModuleFileNameW
GetModuleHandleExW
WriteConsoleW
WriteFile
ExitProcess
GetCommandLineA
GetCommandLineW
GetACP
HeapAlloc
HeapFree
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
OutputDebugStringW
CloseHandle
WaitForSingleObjectEx
CreateThread
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapReAlloc
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
GetProcessHeap
SetFilePointerEx
CreateFileW

shlwapi

PathAppendA

Sections

.text
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/Signature.exe
.exe windows:5 windows x86 arch:x86

bd209cf21d59cbb88c1b092d48921111

Code Sign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9e:aa:94:9e:9a:8b:0d:9f:c0:9d:d2:b6:95:91:82:60:41:c2:d6:97:ea:d8:a1:8c:47:e1:67:cf:a5:62:f2:0d
Signer

Actual PE Digest

9e:aa:94:9e:9a:8b:0d:9f:c0:9d:d2:b6:95:91:82:60:41:c2:d6:97:ea:d8:a1:8c:47:e1:67:cf:a5:62:f2:0d

Digest Algorithm

sha256

PE Digest Matches

true

9e:aa:94:9e:9a:8b:0d:9f:c0:9d:d2:b6:95:91:82:60:41:c2:d6:97:ea:d8:a1:8c:47:e1:67:cf:a5:62:f2:0d
Signer

Actual PE Digest

9e:aa:94:9e:9a:8b:0d:9f:c0:9d:d2:b6:95:91:82:60:41:c2:d6:97:ea:d8:a1:8c:47:e1:67:cf:a5:62:f2:0d

Digest Algorithm

sha256

PE Digest Matches

true

9e:aa:94:9e:9a:8b:0d:9f:c0:9d:d2:b6:95:91:82:60:41:c2:d6:97:ea:d8:a1:8c:47:e1:67:cf:a5:62:f2:0d
Signer

Actual PE Digest

9e:aa:94:9e:9a:8b:0d:9f:c0:9d:d2:b6:95:91:82:60:41:c2:d6:97:ea:d8:a1:8c:47:e1:67:cf:a5:62:f2:0d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\NSecsoftCT\source\repos\Signature\Release\Signature.pdb

Imports

kernel32

WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
LCMapStringW
GetStringTypeW
GetACP
ExitProcess
GetStdHandle
GetFileType
SetStdHandle
QueryPerformanceFrequency
VirtualQuery
VirtualAlloc
GetSystemInfo
HeapQueryInformation
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetCommandLineW
GetCommandLineA
RtlUnwind
GetPrivateProfileStringA
CreateDirectoryA
GetComputerNameW
SetFileAttributesA
WritePrivateProfileStringA
CreateFileA
GetVolumeInformationA
GetDriveTypeA
GetLogicalDrives
OutputDebugStringW
DeviceIoControl
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
ResetEvent
FindResourceExW
GetTempFileNameW
GetWindowsDirectoryW
SearchPathW
GetProfileIntW
GetTickCount
Sleep
SystemTimeToTzSpecificLocalTime
GetFileTime
GetFileSizeEx
GetFileAttributesExW
FileTimeToLocalFileTime
SetErrorMode
VirtualProtect
lstrcmpiW
GetCurrentProcess
DuplicateHandle
WriteFile
UnlockFile
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
HeapFree
GetFullPathNameW
FlushFileBuffers
FindFirstFileW
FindClose
FileTimeToSystemTime
GlobalGetAtomNameW
GetTempPathW
SetFilePointer
GetFileSize
GetFileAttributesW
CreateFileW
DeleteFileW
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetCurrentDirectoryW
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
CompareStringW
GlobalFindAtomW
GetSystemDirectoryW
EncodePointer
GlobalAddAtomW
ResumeThread
SetThreadPriority
CreateEventW
WaitForSingleObject
SetEvent
CloseHandle
CopyFileW
FormatMessageW
MulDiv
LocalFree
GlobalSize
GetCurrentProcessId
VerifyVersionInfoW
VerSetConditionMask
GlobalFree
FreeResource
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
LoadLibraryA
lstrcpyW
WideCharToMultiByte
MultiByteToWideChar
lstrcmpW
lstrcmpA
GlobalDeleteAtom
LoadLibraryW
FindResourceW
SizeofResource
LockResource
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
FreeLibrary
GetVersionExW
GetCurrentThreadId
GetCurrentThread
SetLastError
OutputDebugStringA
GlobalUnlock
GlobalLock
GlobalAlloc
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection

user32

ShowScrollBar
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
ScrollWindow
SetForegroundWindow
GetForegroundWindow
TrackPopupMenu
SetMenu
GetPropW
RemovePropW
AdjustWindowRectEx
InvertRect
HideCaret
GetWindowRgn
EqualRect
GetClassLongW
GetTopWindow
SetScrollInfo
GetScrollInfo
WinHelpW
MonitorFromWindow
WaitMessage
SetCapture
ReleaseCapture
WindowFromPoint
CopyImage
DeleteMenu
RealChildWindowFromPoint
SetPropW
DestroyCursor
CreateMenu
GetComboBoxInfo
TranslateMDISysAccel
DefMDIChildProcW
DefFrameProcW
DrawMenuBar
MapVirtualKeyExW
IsCharLowerW
GetNextDlgGroupItem
PostThreadMessageW
UnregisterClassW
LoadIconW
SendMessageW
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
EnableWindow
PostMessageW
PostQuitMessage
RegisterWindowMessageW
DrawEdge
DrawFrameControl
IsWindowVisible
GetFocus
DrawStateW
SetWindowRgn
RedrawWindow
GetWindowRect
MapWindowPoints
GetSysColor
GetSysColorBrush
DrawFocusRect
FillRect
InflateRect
OffsetRect
IsRectEmpty
GetParent
DrawIconEx
IsWindow
DestroyWindow
CreateDialogIndirectParamW
EndDialog
GetDlgItem
GetNextDlgTabItem
GetActiveWindow
IsWindowEnabled
SetActiveWindow
GetWindowLongW
GetDesktopWindow
DefWindowProcW
GetClassInfoW
SetLayeredWindowAttributes
SetRectEmpty
CopyRect
LoadCursorW
SystemParametersInfoW
GetMonitorInfoW
EnumDisplayMonitors
MessageBoxW
GetWindowThreadProcessId
GetLastActivePopup
GetMenuStringW
GetMenuState
GetSubMenu
GetMenuItemID
GetMenuItemCount
InsertMenuW
AppendMenuW
RemoveMenu
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
GetDC
GetWindowDC
ReleaseDC
BeginPaint
IsClipboardFormatAvailable
SetTimer
KillTimer
IntersectRect
SetParent
MonitorFromPoint
DestroyIcon
LoadImageW
TrackMouseEvent
IsZoomed
CharUpperW
GetAsyncKeyState
LoadMenuW
GetSystemMenu
MessageBeep
NotifyWinEvent
SetCursorPos
SetRect
UnionRect
BringWindowToTop
CreatePopupMenu
LockWindowUpdate
DestroyMenu
EnableScrollBar
GetDoubleClickTime
GetIconInfo
CopyIcon
GetMenuItemInfoW
GetMenuDefaultItem
SetMenuDefaultItem
ModifyMenuW
DestroyAcceleratorTable
SetClassLongW
GetUpdateRect
SendDlgItemMessageA
ToUnicodeEx
GetKeyboardLayout
GetKeyboardState
MapVirtualKeyW
LoadAcceleratorsW
CreateAcceleratorTableW
CopyAcceleratorTableW
FrameRect
CharUpperBuffW
RegisterClipboardFormatW
SubtractRect
GetKeyNameTextW
ReuseDDElParam
wsprintfA
EndPaint
ClientToScreen
ScreenToClient
GetCursorPos
PtInRect
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoW
LoadBitmapW
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
GetKeyState
ValidateRect
ShowOwnedPopups
SetCursor
UpdateWindow
InvalidateRect
GetClassNameW
UpdateLayeredWindow
MapDialogRect
TranslateAcceleratorW
InsertMenuItemW
GetMenu
GetCapture
EndDeferWindowPos
DeferWindowPos
ShowWindow
MoveWindow
BeginDeferWindowPos
SetWindowPlacement
UnpackDDElParam
GetWindowPlacement
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
RegisterClassW
CallWindowProcW
GetMessageTime
GetMessagePos
IsDialogMessageW
GetWindow
SetWindowLongW
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
SetFocus
GetDlgCtrlID
CheckDlgButton
SetWindowPos

gdi32

SetTextColor
SetTextAlign
MoveToEx
TextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
SetRectRgn
RealizePalette
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateRoundRectRgn
Rectangle
SetROP2
OffsetRgn
RoundRect
CreatePalette
GetPaletteEntries
GetNearestPaletteIndex
GetSystemPaletteEntries
EnumFontFamiliesExW
ExtFloodFill
SetPaletteEntries
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
GetViewportOrgEx
LPtoDP
GetWindowOrgEx
SetPixelV
GetTextFaceW
SetPolyFillMode
GetLayout
SetLayout
SetMapMode
SetBkMode
SetBkColor
SelectPalette
SelectObject
ExtSelectClipRgn
SelectClipRgn
SaveDC
DeleteDC
CombineRgn
CreateEllipticRgn
CreateHatchBrush
CreateRectRgn
CreateRectRgnIndirect
CreateSolidBrush
Ellipse
GetBkColor
GetTextColor
GetTextExtentPoint32W
PatBlt
ExtTextOutW
CreatePolygonRgn
Polygon
Polyline
GetTextMetricsW
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDIBitmap
CreateFontIndirectW
CreatePen
CreatePatternBrush
DeleteObject
EnumFontFamiliesW
GetDeviceCaps
GetStockObject
GetTextCharsetInfo
GetObjectW
CopyMetaFileW
CreateDCW
CreateBitmap
Escape
ExcludeClipRect
GetClipBox
GetObjectType
GetPixel
GetViewportExtEx
RestoreDC
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
GetRgnBox
DPtoLP

msimg32

TransparentBlt
AlphaBlend

winspool.drv

ClosePrinter
DocumentPropertiesW
OpenPrinterW

advapi32

RegEnumKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA

shell32

SHGetDesktopFolder
SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetMalloc
SHAppBarMessage
SHGetFileInfoW
DragQueryFileW
DragFinish
ShellExecuteW
SHGetPathFromIDListW

shlwapi

PathRemoveFileSpecW
StrFormatKBSizeW
PathStripToRootW
PathIsUNCW
PathFindFileNameW
PathFindExtensionW
wnsprintfA
SHSetValueA
PathFileExistsA
PathAppendA

uxtheme

DrawThemeBackground
GetThemeColor
GetCurrentThemeName
DrawThemeParentBackground
IsAppThemed
DrawThemeText
GetWindowTheme
GetThemePartSize
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
OpenThemeData
CloseThemeData

ole32

CoInitializeEx
IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CoDisconnectObject
CreateStreamOnHGlobal
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CoInitialize
CoCreateInstance
CoCreateGuid
CoUninitialize

oleaut32

VariantInit
VariantClear
VariantChangeType
LoadTypeLi
VariantTimeToSystemTime
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocString
SystemTimeToVariantTime
VarBstrFromDate
VariantCopy

gdiplus

GdiplusShutdown
GdipGetImagePixelFormat
GdipCreateBitmapFromStream
GdipGetImageWidth
GdipGetImagePaletteSize
GdipDisposeImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipCloneImage
GdiplusStartup
GdipGetImageGraphicsContext
GdipGetImagePalette
GdipAlloc
GdipGetImageHeight
GdipCreateBitmapFromScan0
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipFree

ws2_32

gethostname
inet_ntoa
gethostbyname

oleacc

CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundW

iphlpapi

GetAdaptersAddresses

netapi32

Netbios

Sections

.text
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 321KB - Virtual size: 321KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 133KB - Virtual size: 133KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/SysinternalsSuite/Dbgview.exe
.exe windows:5 windows x86 arch:x86

1e1114d83ae11299940afc2459ee7bc5

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bf:bd:d8:8d:85:25:84:85:d7:05:41:f2:84:30:c4:5f:a1:40:bf:51:9c:12:76:35:10:ae:0d:48:22:6a:52:20
Signer

Actual PE Digest

bf:bd:d8:8d:85:25:84:85:d7:05:41:f2:84:30:c4:5f:a1:40:bf:51:9c:12:76:35:10:ae:0d:48:22:6a:52:20

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\agent\_work\86\s\exe\Win32\Release\dbgview.pdb

Imports

ws2_32

connect
listen
inet_ntoa
htonl
getsockname
bind
accept
WSAGetLastError
WSAStartup
gethostbyname
gethostbyaddr
socket
inet_addr
htons
closesocket

mpr

WNetAddConnection2A
WNetCancelConnection2A

comctl32

ord17
CreateToolbarEx

kernel32

GetModuleFileNameA
GetCommandLineA
GetSystemDirectoryA
GetCurrentDirectoryA
GetFullPathNameA
FindFirstFileA
SearchPathA
GetComputerNameA
QueryPerformanceCounter
QueryPerformanceFrequency
GetTimeFormatA
GetOverlappedResult
ResetEvent
WaitForMultipleObjects
WriteFile
ReadFile
LockResource
LoadResource
SizeofResource
FindResourceA
CreateFileA
RaiseException
GetTickCount
GlobalAlloc
GlobalReAlloc
GlobalLock
GlobalUnlock
HeapAlloc
HeapFree
GetProcessHeap
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcpyA
lstrcatA
GetDateFormatA
GlobalFree
GetFileSize
WriteFileEx
QueueUserAPC
SleepEx
ExpandEnvironmentStringsA
OutputDebugStringA
FlushFileBuffers
GetConsoleCP
CreateEventA
GetStringTypeW
CreateFileW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCurrentThread
GetACP
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
SetConsoleMode
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
GetConsoleMode
GetModuleHandleExW
ExitProcess
EncodePointer
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
RtlUnwind
InterlockedFlushSList
InterlockedPushEntrySList
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OpenMutexA
CreateMutexA
lstrlenA
lstrcpynA
UnmapViewOfFile
FindFirstFileExW
MapViewOfFile
FormatMessageA
SystemTimeToFileTime
GetSystemTime
CloseHandle
FindClose
DeviceIoControl
WaitForSingleObject
SetEvent
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetLastError
TerminateThread
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GlobalMemoryStatus
GetVersion
FreeLibrary
InterlockedIncrement
DeleteFileA
GetEnvironmentVariableA
GetLastError
GetCommandLineW
CreateFileMappingA
GetModuleHandleA
LoadLibraryA
GetStdHandle
GetFileType
LocalFree
LocalAlloc
GetProcAddress
OutputDebugStringW
WaitForSingleObjectEx
FindFirstFileExA
FindNextFileA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetStdHandle
SetConsoleCtrlHandler
WriteConsoleW
SetFilePointerEx
HeapSize
HeapReAlloc
SetEndOfFile
ReadConsoleW
DecodePointer

user32

CloseClipboard
OpenClipboard
CallWindowProcA
GetParent
DrawFocusRect
GetDialogBaseUnits
IsDlgButtonChecked
CheckRadioButton
RegisterClassExA
GetMessageA
IsDialogMessageA
LoadStringA
LoadIconA
LoadBitmapA
SetClipboardData
GetSysColor
ChildWindowFromPoint
GetCursorPos
GetWindowRect
GetClientRect
GetWindowTextA
InvalidateRgn
InvalidateRect
ReleaseDC
SetForegroundWindow
UpdateWindow
TrackPopupMenu
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EmptyClipboard
GetFocus
EnableWindow
DrawTextA
BeginPaint
EndPaint
ClientToScreen
FindWindowA
DeleteMenu
SetWindowLongA
EnableMenuItem
GetSystemMetrics
TranslateAcceleratorA
LoadAcceleratorsA
KillTimer
SetTimer
MsgWaitForMultipleObjects
ReleaseCapture
SetCapture
SetFocus
SendDlgItemMessageA
GetDlgItemTextA
SetDlgItemTextA
DialogBoxParamA
CreateDialogParamA
IsZoomed
IsIconic
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
IsWindow
CreateWindowExA
RegisterClassA
PostQuitMessage
DefWindowProcA
AttachThreadInput
PostMessageA
PeekMessageA
DispatchMessageA
TranslateMessage
RegisterWindowMessageA
MessageBoxA
InsertMenuItemA
GetMenuItemCount
GetSubMenu
CheckMenuItem
GetMenu
LoadCursorA
InflateRect
GetSysColorBrush
SetCursor
SetWindowTextA
GetDlgItem
EndDialog
DialogBoxIndirectParamA
SendMessageA
GetWindowThreadProcessId
ScreenToClient
AppendMenuA
CheckDlgButton
GetDC

gdi32

AbortDoc
SetAbortProc
TextOutA
GetTextExtentPointA
CreateFontA
GetTextExtentPoint32A
ExtTextOutA
SetBkColor
GetObjectA
GetTextMetricsA
GetDeviceCaps
SetMapMode
StartDocA
EndDoc
StartPage
EndPage
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontIndirectA
CreateSolidBrush
DeleteDC
DeleteObject
GetStockObject
SelectObject
SetBkMode
SetTextColor
StretchBlt

comdlg32

FindTextA
ChooseColorA
GetSaveFileNameA
PrintDlgA
ChooseFontA
GetOpenFileNameA

advapi32

InitializeSecurityDescriptor
StartServiceA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegCreateKeyA
RegOpenKeyA
RegOpenKeyExA

shell32

SHGetSpecialFolderLocation
SHGetMalloc
Shell_NotifyIconA
ShellExecuteExA
CommandLineToArgvW
ShellExecuteA
SHBrowseForFolderA

Sections

.text
Size: 375KB - Virtual size: 375KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 382KB - Virtual size: 381KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/SysinternalsSuite/Procmon.exe
.exe windows:6 windows x86 arch:x86

0996ea8cced8948433195a1c50b69e9e

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d2:d1:11:c9:2b:8d:e1:cd:66:8c:29:52:9e:34:3e:f9:a1:52:e4:7c:2e:d1:dd:a3:9c:a3:2f:5b:6c:fa:62:05
Signer

Actual PE Digest

d2:d1:11:c9:2b:8d:e1:cd:66:8c:29:52:9e:34:3e:f9:a1:52:e4:7c:2e:d1:dd:a3:9c:a3:2f:5b:6c:fa:62:05

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\a\1\s\exe\Win32\Release\Procmon.pdb

Imports

ws2_32

getsockname
listen
recv
send
closesocket
gethostbyname
WSAGetLastError
ntohs
WSAStartup
htonl
inet_addr
inet_ntoa
bind
connect
accept
htons
socket
gethostbyaddr
WSASetLastError
getservbyname
getservbyport

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

comctl32

ImageList_SetBkColor
ImageList_AddMasked
ImageList_BeginDrag
ImageList_EndDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_GetImageCount
ImageList_DrawIndirect
CreateStatusWindowW
ImageList_SetOverlayImage
InitCommonControlsEx
ImageList_Add
ImageList_Draw
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_Create
ImageList_GetIconSize
ImageList_DrawEx
ImageList_Destroy

fltlib

FilterSendMessage
FilterGetMessage
FilterReplyMessage
FilterConnectCommunicationPort

kernel32

GetCurrentProcess
GetCurrentThreadId
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
GetFileSize
SetFilePointer
CreateFileMappingW
UnmapViewOfFile
LoadLibraryExA
GetFullPathNameW
GlobalMemoryStatusEx
FreeResource
Sleep
CreateThread
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
InitializeCriticalSection
DeleteCriticalSection
ExpandEnvironmentStringsW
GetCurrentDirectoryW
SetFileAttributesW
GetSystemDirectoryW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeSRWLock
GetSystemInfo
RaiseException
InitializeCriticalSectionEx
GlobalAddAtomW
EnumResourceNamesW
CompareStringW
GetLocaleInfoW
lstrcmpW
lstrcmpiW
MultiByteToWideChar
SetEndOfFile
TryEnterCriticalSection
MapViewOfFile
FileTimeToLocalFileTime
LocalFileTimeToFileTime
ReadFile
FormatMessageW
FileTimeToSystemTime
SystemTimeToFileTime
GetDateFormatW
GetTimeFormatW
GetNumberFormatW
QueryPerformanceCounter
QueryPerformanceFrequency
HeapCreate
SetEvent
ResetEvent
ReleaseSemaphore
CreateEventW
WaitForMultipleObjects
CreateSemaphoreW
SetThreadPriority
GetComputerNameA
GetFileAttributesExW
DecodePointer
GetCurrentProcessId
SetProcessShutdownParameters
GetComputerNameW
SetConsoleCtrlHandler
OpenThread
GetSystemDirectoryA
TrySubmitThreadpoolCallback
LoadLibraryA
FindClose
FindFirstFileW
FindNextFileW
SetEnvironmentVariableW
ExpandEnvironmentStringsA
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
EncodePointer
InterlockedPopEntrySList
InterlockedPushEntrySList
WideCharToMultiByte
GetStringTypeW
LCMapStringEx
OpenProcess
CreateProcessW
TerminateProcess
ExitProcess
WaitForSingleObject
GetLastError
GetEnvironmentVariableW
VerifyVersionInfoW
lstrlenW
MulDiv
LoadLibraryW
FreeLibrary
GetCPInfo
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetConsoleCP
ExitThread
FreeLibraryAndExitThread
CreateRemoteThreadEx
GetThreadId
ResumeThread
GetCurrentThread
LeaveCriticalSection
EnterCriticalSection
CloseHandle
GetTempPathW
WriteFile
GetTempFileNameW
DeleteFileW
CreateFileW
VerSetConditionMask
GetModuleFileNameW
GetPrivateProfileStringW
GetPrivateProfileIntW
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetFileAttributesW
GlobalLock
GlobalUnlock
GlobalAlloc
LocalFree
LocalAlloc
GetProcAddress
GetModuleHandleW
GetFileType
GetCommandLineW
GetStdHandle
LoadLibraryExW
GetVersionExW
SetLastError
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
SetConsoleMode
ReadConsoleInputW
ReadConsoleW
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
WriteConsoleW
SetCurrentDirectoryW
InitializeSListHead
LCMapStringW

user32

GetKeyState
GetUpdateRect
GetUpdateRgn
ScrollWindowEx
IntersectRect
GetClassLongW
EqualRect
FlashWindowEx
LoadStringA
DrawEdge
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
GetMessagePos
PostQuitMessage
GetWindowPlacement
SetWindowPlacement
CheckRadioButton
CharLowerW
LoadAcceleratorsW
CreatePopupMenu
RemoveMenu
InsertMenuItemW
SetRectEmpty
ChildWindowFromPoint
FindWindowExW
FindWindowW
SetForegroundWindow
IsIconic
WaitForInputIdle
CreateIconFromResourceEx
GetDlgItemInt
GetActiveWindow
RegisterWindowMessageW
GetAsyncKeyState
SetWindowTextA
EnumChildWindows
UnionRect
GetPropW
SetPropW
DrawFrameControl
CheckMenuRadioItem
SetRect
WindowFromPoint
ClientToScreen
AdjustWindowRectEx
SetMenuDefaultItem
GetMenuItemInfoW
DeleteMenu
AppendMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
EnableMenuItem
DestroyMenu
LoadMenuW
GetCapture
SetFocus
GetDlgCtrlID
SetDlgItemInt
CreateDialogParamW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
GetClassInfoExW
RegisterClassExW
UnregisterClassW
UnregisterHotKey
RegisterHotKey
TrackMouseEvent
MonitorFromPoint
MapWindowPoints
GetCursor
GetCursorPos
GetFocus
LoadStringW
LoadIconW
MessageBeep
SetActiveWindow
GetDesktopWindow
DialogBoxParamW
LoadImageW
GetWindow
MessageBoxW
EnableWindow
IsDlgButtonChecked
CheckDlgButton
GetDlgItemTextW
DestroyWindow
IsWindow
GetWindowRect
SetDlgItemTextW
GetAncestor
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
GetScrollInfo
DrawIconEx
DestroyIcon
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetClassNameW
GetParent
SetClassLongW
SetWindowLongW
GetWindowLongW
PtInRect
OffsetRect
CopyRect
FrameRect
FillRect
DrawFocusRect
ScreenToClient
GetClientRect
IsDialogMessageW
GetForegroundWindow
SetMenuItemInfoW
SetMenuInfo
GetMenuInfo
ModifyMenuW
InsertMenuW
GetMenuStringW
SetMenu
GetMenu
TranslateAcceleratorW
CharNextW
GetWindowTextLengthW
GetWindowTextW
ShowScrollBar
SetScrollPos
RedrawWindow
ValidateRect
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetWindowDC
GetDC
UpdateWindow
DrawTextW
TrackPopupMenuEx
GetSystemMetrics
IsWindowEnabled
KillTimer
SetTimer
ReleaseCapture
SetCapture
IsZoomed
IsWindowVisible
SetWindowPos
MoveWindow
ShowWindow
IsChild
CreateWindowExW
CallWindowProcW
IsMenu
GetIconInfo
GetWindowThreadProcessId
DefWindowProcW
PostMessageW
GetSysColor
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
LoadCursorW
InflateRect
GetSysColorBrush
SetCursor
SetWindowTextW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
SendMessageW
SetScrollInfo

gdi32

RestoreDC
SetBrushOrgEx
SetPixel
PatBlt
SaveDC
SetROP2
GetPixel
ExcludeClipRect
CreatePatternBrush
CreateBitmap
SelectClipRgn
RectInRegion
GetBkMode
CreateRectRgnIndirect
SetBkMode
CreateRectRgn
GdiFlush
GetCurrentObject
CreateFontW
GetObjectW
GetBitmapBits
GetBkColor
CreateDIBSection
SetViewportOrgEx
Polyline
Polygon
ExtTextOutW
TextOutW
MoveToEx
GetTextMetricsW
SetMapMode
GetDeviceCaps
SetTextColor
SetBkColor
SelectObject
Rectangle
LineTo
GetTextExtentPoint32W
GetStockObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
CreateSolidBrush
EndPage
StartPage
EndDoc
StartDocW
SetTextAlign

comdlg32

ChooseColorW
GetSaveFileNameW
GetOpenFileNameW
ChooseFontW
PrintDlgW
FindTextW

advapi32

RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
ConvertStringSidToSidW
ConvertSidToStringSidW
RegSetValueW
RegEnumKeyW
LookupAccountSidW
MapGenericMask
GetTokenInformation
GetLengthSid
FreeSid
EqualSid
AllocateAndInitializeSid
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
RegCreateKeyW
RegOpenKeyExW
RegOpenKeyW
RegCloseKey

shell32

SHGetSpecialFolderLocation
ShellExecuteW
SHGetPathFromIDListW
CommandLineToArgvW
SHChangeNotify
SHBrowseForFolderW
ExtractIconExW
SHGetMalloc
DragQueryFileW
ShellExecuteExW
SHGetFileInfoW

ole32

CoTaskMemFree
RegisterDragDrop
ReleaseStgMedium
CoTaskMemRealloc
OleUninitialize
CreateBindCtx
OleInitialize
CoTaskMemAlloc
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx

oleaut32

SysFreeString
SysStringLen
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocString
VariantInit
VariantClear
VariantChangeType
SysAllocStringByteLen
VarUI4FromStr
VariantTimeToSystemTime
SysAllocStringLen
SafeArrayGetElement

shlwapi

SHAutoComplete

uxtheme

IsAppThemed
SetWindowTheme
IsThemeActive

dwmapi

DwmSetWindowAttribute
DwmDefWindowProc

ntdll

RtlGetVersion

Sections

.text
Size: 867KB - Virtual size: 867KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 243KB - Virtual size: 242KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/SysinternalsSuite/Procmon64.exe
.exe windows:6 windows x64 arch:x64

8c8d3fd6f0f8d0561ce79106fb84a3db

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:62:50:ca:5a:d6:4d:2d:fc:5f:62:23:a0:9a:17:47:5b:24:84:3d:42:ad:20:c5:f9:9f:ea:09:e8:dd:87:3e
Signer

Actual PE Digest

0b:62:50:ca:5a:d6:4d:2d:fc:5f:62:23:a0:9a:17:47:5b:24:84:3d:42:ad:20:c5:f9:9f:ea:09:e8:dd:87:3e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\1\s\exe\x64\Release\Procmon64.pdb

Imports

ws2_32

recv
listen
getsockname
send
socket
connect
WSAGetLastError
ntohs
WSAStartup
htonl
inet_addr
inet_ntoa
gethostbyaddr
getservbyport
getservbyname
closesocket
htons
bind
accept
gethostbyname
WSASetLastError

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

comctl32

ImageList_SetBkColor
ImageList_AddMasked
ImageList_BeginDrag
ImageList_EndDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ImageList_GetImageCount
ImageList_DrawIndirect
CreateStatusWindowW
ImageList_SetOverlayImage
InitCommonControlsEx
ImageList_Add
ImageList_Draw
ImageList_GetIcon
ImageList_ReplaceIcon
ImageList_Create
ImageList_GetIconSize
ImageList_DrawEx
ImageList_Destroy

fltlib

FilterSendMessage
FilterGetMessage
FilterReplyMessage
FilterConnectCommunicationPort

kernel32

IsWow64Process
GetCurrentProcess
GetCurrentThreadId
SuspendThread
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualAlloc
VirtualProtect
VirtualFree
VirtualQuery
GetFileSize
SetFilePointer
CreateFileMappingW
UnmapViewOfFile
LoadLibraryExA
GetFullPathNameW
GlobalMemoryStatusEx
FreeResource
Sleep
CreateThread
GetSystemTimeAsFileTime
GetTickCount
GetTickCount64
InitializeCriticalSection
DeleteCriticalSection
ExpandEnvironmentStringsW
GetCurrentDirectoryW
SetFileAttributesW
GetSystemDirectoryW
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitializeSRWLock
GetSystemInfo
RaiseException
InitializeCriticalSectionEx
GlobalAddAtomW
EnumResourceNamesW
SetCurrentDirectoryW
CompareStringW
GetLocaleInfoW
lstrcmpiW
MultiByteToWideChar
SetEndOfFile
TryEnterCriticalSection
MapViewOfFile
FileTimeToLocalFileTime
LocalFileTimeToFileTime
ReadFile
FormatMessageW
FileTimeToSystemTime
SystemTimeToFileTime
GetDateFormatW
GetTimeFormatW
GetNumberFormatW
QueryPerformanceCounter
QueryPerformanceFrequency
HeapCreate
SetEvent
ResetEvent
ReleaseSemaphore
CreateEventW
WaitForMultipleObjects
CreateSemaphoreW
SetThreadPriority
GetComputerNameA
GetFileAttributesExW
DecodePointer
GetCurrentProcessId
SetProcessShutdownParameters
GetComputerNameW
SetConsoleCtrlHandler
OpenThread
GetSystemDirectoryA
TrySubmitThreadpoolCallback
LoadLibraryA
FindClose
FindFirstFileW
FindNextFileW
SetEnvironmentVariableW
ExpandEnvironmentStringsA
EncodePointer
OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
WaitForSingleObjectEx
InitializeCriticalSectionAndSpinCount
InterlockedPushEntrySList
WideCharToMultiByte
GetStringTypeW
LCMapStringEx
GetCPInfo
RtlPcToFileHeader
RtlUnwindEx
TlsAlloc
OpenProcess
CreateProcessW
TerminateProcess
ExitProcess
WaitForSingleObject
GetLastError
GetEnvironmentVariableW
VerifyVersionInfoW
lstrlenW
MulDiv
LoadLibraryW
FreeLibrary
TlsGetValue
TlsSetValue
TlsFree
RtlUnwind
GetModuleHandleExW
GetConsoleCP
ExitThread
FreeLibraryAndExitThread
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CreateRemoteThreadEx
GetThreadId
ResumeThread
GetCurrentThread
LeaveCriticalSection
EnterCriticalSection
CloseHandle
GetTempPathW
WriteFile
GetTempFileNameW
DeleteFileW
CreateFileW
VerSetConditionMask
GetModuleFileNameW
GetPrivateProfileStringW
GetPrivateProfileIntW
FindResourceW
SizeofResource
LockResource
LoadResource
FindResourceExW
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetFileAttributesW
GlobalLock
GlobalUnlock
GlobalAlloc
LocalFree
LocalAlloc
GetProcAddress
GetModuleHandleW
GetFileType
GetCommandLineW
GetStdHandle
LoadLibraryExW
GetVersionExW
SetLastError
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleMode
SetConsoleMode
ReadConsoleInputW
ReadConsoleW
GetConsoleOutputCP
GetFileSizeEx
SetFilePointerEx
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
WriteConsoleW
lstrcmpW
InterlockedPopEntrySList
LCMapStringW

user32

IntersectRect
GetClassLongPtrW
EqualRect
FlashWindowEx
LoadStringA
DrawEdge
GetMessageW
TranslateMessage
DispatchMessageW
PeekMessageW
GetMessagePos
PostQuitMessage
GetWindowPlacement
SetWindowPlacement
CheckRadioButton
CharLowerW
LoadAcceleratorsW
CreatePopupMenu
RemoveMenu
InsertMenuItemW
SetRectEmpty
ChildWindowFromPoint
TranslateAcceleratorW
CharNextW
IsMenu
GetWindowThreadProcessId
FindWindowExW
FindWindowW
SetForegroundWindow
IsIconic
WaitForInputIdle
CreateIconFromResourceEx
GetDlgItemInt
GetActiveWindow
RegisterWindowMessageW
GetAsyncKeyState
SetWindowTextA
EnumChildWindows
UnionRect
GetPropW
SetPropW
DrawFrameControl
CheckMenuRadioItem
SetRect
WindowFromPoint
ClientToScreen
AdjustWindowRectEx
SetMenuDefaultItem
GetMenuItemInfoW
DeleteMenu
AppendMenuW
GetMenuItemCount
GetMenuItemID
GetSubMenu
EnableMenuItem
DestroyMenu
LoadMenuW
GetCapture
SetFocus
GetDlgCtrlID
SetDlgItemInt
CreateDialogParamW
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
GetClassInfoExW
RegisterClassExW
UnregisterClassW
UnregisterHotKey
RegisterHotKey
ScrollWindowEx
MonitorFromPoint
GetIconInfo
MapWindowPoints
GetCursor
GetCursorPos
GetFocus
LoadStringW
LoadIconW
MessageBeep
SetActiveWindow
GetDesktopWindow
DialogBoxParamW
LoadImageW
GetWindow
MessageBoxW
EnableWindow
IsDlgButtonChecked
CheckDlgButton
GetDlgItemTextW
DestroyWindow
IsWindow
GetWindowRect
SetDlgItemTextW
GetAncestor
GetMonitorInfoW
MonitorFromWindow
GetScrollInfo
SetScrollInfo
DrawIconEx
DestroyIcon
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetClassNameW
GetParent
SetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
GetWindowLongW
PtInRect
OffsetRect
GetUpdateRgn
GetUpdateRect
GetKeyState
IsDialogMessageW
GetForegroundWindow
SetMenuItemInfoW
SetMenuInfo
GetMenuInfo
ModifyMenuW
InsertMenuW
GetMenuStringW
CopyRect
FrameRect
FillRect
DrawFocusRect
ScreenToClient
GetClientRect
GetWindowTextLengthW
GetWindowTextW
ShowScrollBar
SetScrollPos
RedrawWindow
ValidateRect
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetWindowDC
GetDC
UpdateWindow
DrawTextW
TrackPopupMenuEx
GetSystemMetrics
IsWindowEnabled
KillTimer
SetTimer
ReleaseCapture
SetCapture
IsZoomed
IsWindowVisible
SetMenu
TrackMouseEvent
GetMenu
SetWindowPos
MoveWindow
ShowWindow
IsChild
CreateWindowExW
CallWindowProcW
DefWindowProcW
PostMessageW
GetSysColor
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
LoadCursorW
InflateRect
GetSysColorBrush
SetCursor
SetWindowTextW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
SendMessageW
SystemParametersInfoW

gdi32

RestoreDC
SetBrushOrgEx
SetPixel
PatBlt
SaveDC
SetROP2
GetPixel
ExcludeClipRect
CreatePatternBrush
CreateBitmap
SelectClipRgn
RectInRegion
GetBkMode
CreateRectRgnIndirect
CreateRectRgn
GdiFlush
SetBkMode
GetCurrentObject
CreateFontW
GetObjectW
GetBitmapBits
GetBkColor
CreateDIBSection
SetViewportOrgEx
Polyline
Polygon
ExtTextOutW
TextOutW
MoveToEx
GetTextMetricsW
SetMapMode
GetDeviceCaps
SetTextColor
SetBkColor
SelectObject
Rectangle
LineTo
GetTextExtentPoint32W
GetStockObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
CreateSolidBrush
EndPage
StartPage
EndDoc
StartDocW
SetTextAlign

comdlg32

ChooseColorW
GetSaveFileNameW
GetOpenFileNameW
ChooseFontW
PrintDlgW
FindTextW

advapi32

RegQueryValueExW
RegOpenKeyExA
RegQueryValueExA
ConvertStringSidToSidW
ConvertSidToStringSidW
RegSetValueW
RegEnumKeyW
LookupAccountSidW
MapGenericMask
GetTokenInformation
GetLengthSid
FreeSid
EqualSid
AllocateAndInitializeSid
RegQueryInfoKeyW
RegEnumValueW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegSetValueExW
RegCreateKeyW
RegOpenKeyExW
RegOpenKeyW
RegCloseKey

shell32

SHGetSpecialFolderLocation
ShellExecuteW
SHGetPathFromIDListW
CommandLineToArgvW
SHChangeNotify
SHBrowseForFolderW
ExtractIconExW
SHGetMalloc
DragQueryFileW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
ReleaseStgMedium
CreateBindCtx
CoInitializeEx
RegisterDragDrop
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateInstance
CoSetProxyBlanket
OleUninitialize

oleaut32

SysFreeString
SysStringLen
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayAccessData
SafeArrayUnaccessData
SysAllocString
VariantInit
VariantClear
VariantChangeType
SysAllocStringByteLen
VarUI4FromStr
VariantTimeToSystemTime
SysAllocStringLen
SafeArrayGetElement

shlwapi

SHAutoComplete

uxtheme

IsThemeActive
IsAppThemed
SetWindowTheme

dwmapi

DwmSetWindowAttribute
DwmDefWindowProc

ntdll

RtlGetVersion
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

Sections

.text
Size: 947KB - Virtual size: 947KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 311KB - Virtual size: 311KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/SysinternalsSuite/dbgview64.exe
.exe windows:5 windows x64 arch:x64

0d2cbe6b8a0b15c4e2f5a77d616d765b

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

53:01:b8:68:a4:d1:74:3e:3f:42:05:07:8b:85:16:9a:04:1c:b9:ab:ff:82:d8:33:72:45:5d:75:60:25:c7:48
Signer

Actual PE Digest

53:01:b8:68:a4:d1:74:3e:3f:42:05:07:8b:85:16:9a:04:1c:b9:ab:ff:82:d8:33:72:45:5d:75:60:25:c7:48

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\agent\_work\86\s\exe\x64\Release\dbgview64.pdb

Imports

ws2_32

connect
listen
inet_ntoa
htonl
getsockname
bind
accept
WSAGetLastError
WSAStartup
gethostbyname
gethostbyaddr
socket
inet_addr
htons
closesocket

mpr

WNetAddConnection2A
WNetCancelConnection2A

comctl32

ord17
CreateToolbarEx

kernel32

GetCommandLineA
GetSystemDirectoryA
GetCurrentDirectoryA
GetFullPathNameA
FindFirstFileA
SearchPathA
GetComputerNameA
QueryPerformanceCounter
QueryPerformanceFrequency
GetTimeFormatA
GetOverlappedResult
ResetEvent
WaitForMultipleObjects
WriteFile
ReadFile
LockResource
LoadResource
SizeofResource
FindResourceA
CreateFileA
RaiseException
GetTickCount
GlobalAlloc
GlobalReAlloc
GlobalLock
GlobalUnlock
HeapAlloc
HeapFree
GetProcessHeap
FileTimeToLocalFileTime
FileTimeToSystemTime
lstrcpyA
lstrcatA
GetDateFormatA
GlobalFree
GetFileSize
WriteFileEx
QueueUserAPC
SleepEx
ExpandEnvironmentStringsA
OutputDebugStringA
FlushFileBuffers
GetConsoleCP
ReadConsoleW
GetStringTypeW
CreateFileW
CreateFileMappingA
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCurrentThread
GetACP
WideCharToMultiByte
MultiByteToWideChar
GetModuleFileNameW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
SetConsoleMode
ReadConsoleInputA
PeekConsoleInputA
GetNumberOfConsoleInputEvents
GetConsoleMode
GetModuleHandleExW
ExitProcess
RtlPcToFileHeader
EncodePointer
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
InterlockedFlushSList
InterlockedPushEntrySList
RtlUnwindEx
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventA
OpenMutexA
CreateMutexA
FindFirstFileExW
lstrlenA
lstrcpynA
UnmapViewOfFile
MapViewOfFile
FormatMessageA
SystemTimeToFileTime
GetSystemTime
CloseHandle
FindClose
DeviceIoControl
WaitForSingleObject
SetEvent
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
SetLastError
TerminateThread
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
GlobalMemoryStatus
GetVersion
FreeLibrary
DeleteFileA
GetEnvironmentVariableA
GetLastError
GetCommandLineW
GetModuleFileNameA
GetModuleHandleA
LoadLibraryA
GetStdHandle
GetFileType
LocalFree
LocalAlloc
FindNextFileA
GetProcAddress
OutputDebugStringW
WaitForSingleObjectEx
FindFirstFileExA
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetEnvironmentVariableW
SetStdHandle
SetConsoleCtrlHandler
WriteConsoleW
SetFilePointerEx
HeapSize
HeapReAlloc
SetEndOfFile
EnumSystemLocalesW
RtlUnwind

user32

SetClipboardData
CloseClipboard
OpenClipboard
CallWindowProcA
GetParent
DrawFocusRect
GetDialogBaseUnits
IsDlgButtonChecked
CheckRadioButton
RegisterClassExA
GetMessageA
IsDialogMessageA
EmptyClipboard
LoadIconA
LoadBitmapA
FindWindowA
GetSysColor
ChildWindowFromPoint
GetCursorPos
GetWindowRect
GetClientRect
GetWindowTextA
InvalidateRgn
ReleaseDC
GetDC
SetForegroundWindow
GetFocus
EnableWindow
DrawTextA
BeginPaint
EndPaint
ClientToScreen
LoadStringA
UpdateWindow
TrackPopupMenu
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
DeleteMenu
AppendMenuA
SetWindowLongPtrA
GetSystemMetrics
TranslateAcceleratorA
LoadAcceleratorsA
KillTimer
SetTimer
MsgWaitForMultipleObjects
ReleaseCapture
SetCapture
SetFocus
SendDlgItemMessageA
GetDlgItemTextA
SetDlgItemTextA
DialogBoxParamA
CreateDialogParamA
IsZoomed
IsIconic
SetWindowPos
MoveWindow
ShowWindow
DestroyWindow
IsWindow
CreateWindowExA
RegisterClassA
PostQuitMessage
DefWindowProcA
AttachThreadInput
PostMessageA
PeekMessageA
DispatchMessageA
TranslateMessage
RegisterWindowMessageA
MessageBoxA
InsertMenuItemA
GetMenuItemCount
GetSubMenu
CheckMenuItem
GetMenu
LoadCursorA
InflateRect
GetSysColorBrush
SetCursor
SetWindowTextA
GetDlgItem
EndDialog
DialogBoxIndirectParamA
SendMessageA
GetWindowThreadProcessId
ScreenToClient
EnableMenuItem
CheckDlgButton
InvalidateRect

gdi32

AbortDoc
SetAbortProc
TextOutA
GetTextExtentPointA
CreateFontA
GetTextExtentPoint32A
GetDeviceCaps
SetMapMode
StartDocA
EndDoc
StartPage
EndPage
CreateCompatibleBitmap
CreateCompatibleDC
CreateFontIndirectA
CreateSolidBrush
DeleteDC
DeleteObject
GetStockObject
SelectObject
SetBkMode
StretchBlt
SetTextColor
GetTextMetricsA
GetObjectA
ExtTextOutA
SetBkColor

comdlg32

FindTextA
ChooseColorA
GetSaveFileNameA
PrintDlgA
ChooseFontA
GetOpenFileNameA

advapi32

InitializeSecurityDescriptor
StartServiceA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
DeleteService
CreateServiceA
ControlService
CloseServiceHandle
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegQueryValueExW
RegQueryValueExA
RegCreateKeyA
RegOpenKeyA
RegOpenKeyExA

shell32

SHGetSpecialFolderLocation
SHGetMalloc
Shell_NotifyIconA
ShellExecuteExA
ShellExecuteA
SHBrowseForFolderA

Sections

.text
Size: 456KB - Virtual size: 456KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 119KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 461KB - Virtual size: 460KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/SysinternalsSuite/procdump.exe
.exe windows:6 windows x86 arch:x86

06ad3b6fe23128d330b3053f2d666451

Code Sign

33:00:00:02:cb:b7:75:39:fb:02:71:42:36:00:00:00:00:02:cb
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/05/2022, 20:45

Not After

11/05/2023, 20:45

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b2:aa:2c:01:d5:5f:b0:58:0d:a2:03:3b:62:5f:76:4c:a7:bc:43:7e:ac:4d:b2:7c:d4:32:d7:43:b4:bd:08:cd
Signer

Actual PE Digest

b2:aa:2c:01:d5:5f:b0:58:0d:a2:03:3b:62:5f:76:4c:a7:bc:43:7e:ac:4d:b2:7c:d4:32:d7:43:b4:bd:08:cd

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\a\1\s\Win32\Release\ProcDump.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

shlwapi

StrStrIW

kernel32

Sleep
DeleteCriticalSection
K32GetModuleBaseNameW
ReadProcessMemory
K32EnumProcessModules
GetTickCount
SizeofResource
GetCurrentProcess
ExpandEnvironmentStringsW
WaitForDebugEvent
InitializeCriticalSection
GetFileAttributesW
DebugActiveProcessStop
ResumeThread
ContinueDebugEvent
OpenProcess
GetLastError
LockResource
DeleteFileW
CreateThread
LoadResource
FindResourceW
DebugActiveProcess
CreateProcessW
FreeLibrary
GetExitCodeProcess
MultiByteToWideChar
FormatMessageW
SetConsoleCtrlHandler
TerminateProcess
GetFullPathNameW
WaitForMultipleObjects
GetEnvironmentVariableA
K32GetProcessImageFileNameW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
CloseHandle
GetCurrentDirectoryW
GetCurrentProcessId
SystemTimeToTzSpecificLocalTime
GetSystemTime
DebugBreak
IsDebuggerPresent
GetFileSizeEx
CreateFileW
ReleaseSemaphore
GetProcessId
GetThreadContext
SetFilePointerEx
GetTimeFormatW
ExitProcess
CreateSemaphoreW
GetDateFormatW
OpenThread
DeviceIoControl
GetCurrentThread
VirtualQueryEx
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReadFile
GetConsoleOutputCP
FlushFileBuffers
ReadConsoleW
DecodePointer
SetEvent
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetModuleFileNameW
WaitForSingleObject
GetFileType
GetModuleHandleW
LocalFree
GetProcAddress
LocalAlloc
GetStdHandle
GetCommandLineW
LoadLibraryExW
GetVersionExW
SetLastError
CreateEventW
OpenEventW
GetStringTypeW
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
GetSystemInfo
ReadConsoleInputW
SetConsoleMode
GetConsoleMode
WideCharToMultiByte
LCMapStringW
CompareStringW
HeapAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
RaiseException
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetConsoleCP
SetStdHandle
WriteFile
GetCommandLineA
HeapFree

user32

SendMessageW
EndDialog
GetDlgItem
SetCursor
LoadCursorW
DialogBoxIndirectParamW
GetSysColorBrush
EnumWindows
InflateRect
wsprintfW
GetWindowThreadProcessId
IsWindowVisible
IsHungAppWindow
LoadStringA
SetWindowTextW

gdi32

StartPage
EndDoc
GetDeviceCaps
SetMapMode
StartDocW
EndPage

comdlg32

PrintDlgW

advapi32

RegDeleteValueW
CloseServiceHandle
OpenSCManagerW
EnumServicesStatusExW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegDeleteKeyW
RegCreateKeyExW
RegOpenKeyW
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegCreateKeyW
RegQueryValueExW

shell32

CommandLineToArgvW

ole32

CoInitializeEx
CoCreateInstance
CoAllowSetForegroundWindow
CLSIDFromString
CoUninitialize

pdh

PdhGetFormattedCounterValue
PdhCollectQueryData
PdhAddCounterW
PdhOpenQueryW

Sections

.text
Size: 216KB - Virtual size: 216KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 115KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 416KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/SysinternalsSuite/procdump64.exe
.exe windows:6 windows x64 arch:x64

6216b9e2015376e4cab2df349f9e6cdd

Code Sign

33:00:00:02:cb:b7:75:39:fb:02:71:42:36:00:00:00:00:02:cb
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/05/2022, 20:45

Not After

11/05/2023, 20:45

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3a:57:37:0a:5f:c7:a8:b5:15:0f:cd:78:78:8f:f7:bd:e2:ba:34:d4:8b:ef:e9:8f:9d:b8:2d:e8:8e:99:85:c3
Signer

Actual PE Digest

3a:57:37:0a:5f:c7:a8:b5:15:0f:cd:78:78:8f:f7:bd:e2:ba:34:d4:8b:ef:e9:8f:9d:b8:2d:e8:8e:99:85:c3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\1\s\x64\Release\ProcDump64.pdb

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

shlwapi

StrStrIW

kernel32

Sleep
DeleteCriticalSection
K32GetModuleBaseNameW
ReadProcessMemory
K32EnumProcessModules
GetTickCount
GetCurrentProcess
WaitForDebugEvent
InitializeCriticalSection
DebugActiveProcessStop
ResumeThread
ContinueDebugEvent
OpenProcess
GetLastError
CreateThread
DebugActiveProcess
CreateProcessW
FreeLibrary
ExpandEnvironmentStringsW
MultiByteToWideChar
FormatMessageW
SetConsoleCtrlHandler
TerminateProcess
GetFullPathNameW
WaitForMultipleObjects
GetEnvironmentVariableA
GetFileAttributesW
K32GetProcessImageFileNameW
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
GetSystemInfo
GetCurrentDirectoryW
GetCurrentProcessId
SystemTimeToTzSpecificLocalTime
WaitForSingleObject
DebugBreak
IsDebuggerPresent
GetFileSizeEx
CreateFileW
DeleteFileW
ReleaseSemaphore
GetProcessId
GetThreadContext
SetFilePointerEx
GetTimeFormatW
ExitProcess
CreateSemaphoreW
GetDateFormatW
OpenThread
DeviceIoControl
GetCurrentThread
VirtualQueryEx
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
ReadFile
GetConsoleOutputCP
FlushFileBuffers
ReadConsoleW
CloseHandle
SetEvent
LeaveCriticalSection
EnterCriticalSection
LoadLibraryW
GetModuleFileNameW
GetFileType
GetModuleHandleW
LocalFree
GetProcAddress
LocalAlloc
GetStdHandle
GetCommandLineW
LoadLibraryExW
GetVersionExW
SetLastError
CreateEventW
OpenEventW
GetStringTypeW
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
GetSystemTime
ReadConsoleInputW
SetConsoleMode
GetConsoleMode
WideCharToMultiByte
LCMapStringW
CompareStringW
FlsFree
FlsSetValue
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
ResetEvent
WaitForSingleObjectEx
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
GetConsoleCP
SetStdHandle
WriteFile
GetCommandLineA
HeapFree
HeapAlloc
FlsAlloc
FlsGetValue

user32

SendMessageW
EndDialog
GetDlgItem
SetCursor
LoadCursorW
DialogBoxIndirectParamW
GetSysColorBrush
EnumWindows
InflateRect
wsprintfW
GetWindowThreadProcessId
IsWindowVisible
IsHungAppWindow
LoadStringA
SetWindowTextW

gdi32

EndDoc
GetDeviceCaps
SetMapMode
StartDocW
EndPage
StartPage

comdlg32

PrintDlgW

advapi32

RegOpenKeyExW
CloseServiceHandle
OpenSCManagerW
EnumServicesStatusExW
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
RegDeleteKeyW
RegCreateKeyExW
RegDeleteValueW
RegCloseKey
RegSetValueExW
RegOpenKeyW
RegCreateKeyW
RegQueryValueExW

shell32

CommandLineToArgvW

ole32

CoInitializeEx
CoCreateInstance
CoAllowSetForegroundWindow
CLSIDFromString
CoUninitialize

pdh

PdhGetFormattedCounterValue
PdhCollectQueryData
PdhAddCounterW
PdhOpenQueryW

Sections

.text
Size: 243KB - Virtual size: 242KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 141KB - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/SysinternalsSuite/procexp.exe
.exe windows:6 windows x86 arch:x86

dbcf2a4deb216c4be49068990ac64d93

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:2e:d0:2c:26:7e:28:57:5a:76:a4:ef:31:41:c8:50:34:5e:93:1e:06:49:95:62:e6:b7:77:25:e0:43:e1:7e
Signer

Actual PE Digest

2d:2e:d0:2c:26:7e:28:57:5a:76:a4:ef:31:41:c8:50:34:5e:93:1e:06:49:95:62:e6:b7:77:25:e0:43:e1:7e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\a\1\s\exe\Win32\Release\procexp.pdb

Imports

shlwapi

PathIsNetworkPathW
StrCmpIW
SHAutoComplete
ColorHLSToRGB
ColorRGBToHLS
StrStrIW
ord176
UrlUnescapeW

iphlpapi

GetExtendedTcpTable
GetExtendedUdpTable

ws2_32

htons
ntohl
ntohs
htonl
gethostbyaddr
getservbyport
WSAStartup

mpr

WNetGetConnectionW

comctl32

ImageList_ReplaceIcon
ImageList_Add
InitCommonControlsEx
ImageList_Destroy
ImageList_DrawEx
ImageList_GetIconSize
ImageList_Create
ImageList_AddMasked
ImageList_BeginDrag
ImageList_EndDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
ImageList_DragShowNolock
ord17
PropertySheetW
CreateStatusWindowW
ord413
CreatePropertySheetPageW
ImageList_GetIcon
ord410

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

credui

CredUIPromptForCredentialsW

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

crypt32

CertDuplicateCertificateContext
CertGetNameStringW

aclui

ord1

powrprof

SetSuspendState
IsPwrSuspendAllowed
IsPwrHibernateAllowed

wtsapi32

WTSDisconnectSession
WTSSendMessageW
WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSLogoffSession
WTSFreeMemory

uxtheme

OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemePartSize
SetWindowTheme
EnableThemeDialogTexture

ntdll

NtSetInformationProcess
VerSetConditionMask
NtLoadDriver
NtCreateKey
NtOpenKey
NtQuerySymbolicLinkObject
NtQueryEvent
NtQueryMutant
NtQuerySystemInformation
NtQueryInformationThread
NtQuerySection
NtResumeThread
NtSuspendProcess
NtResumeProcess
NtOpenThread
RtlCreateQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlDestroyQueryDebugBuffer
NtOpenSymbolicLinkObject
NtQueryInformationProcess
NtQueryObject
NtQuerySemaphore
NtSuspendThread
RtlUnwind

gdi32

GetDeviceCaps
GetStockObject
LineTo
RectInRegion
SelectClipRgn
SelectObject
GetBkMode
SetDCPenColor
SetBkMode
SetTextColor
GetTextMetricsW
MoveToEx
Polyline
ExtTextOutW
SetViewportOrgEx
CreateFontIndirectW
GetTextExtentPoint32W
Rectangle
SetTextAlign
TextOutW
SetMapMode
StartDocW
EndDoc
StartPage
EndPage
CreateBitmap
CreatePatternBrush
ExcludeClipRect
GetCurrentObject
PatBlt
Polygon
GetTextExtentExPointW
RestoreDC
SaveDC
SetROP2
GetBkColor
DeleteDC
CreateSolidBrush
CreateRectRgnIndirect
CreatePen
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
GetObjectW
CreateDIBSection
SetBkColor

comdlg32

PrintDlgW
ChooseFontW
CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW
ChooseColorW
FindTextW

kernel32

GetLongPathNameW
WriteFile
CloseHandle
GetLastError
SetErrorMode
InitializeCriticalSection
Sleep
GetCurrentProcess
ExitThread
TlsAlloc
TlsSetValue
CreateProcessW
OpenProcess
GetVersion
GetSystemWindowsDirectoryW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
IsWow64Process
GetSystemWow64DirectoryW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LocalFree
FormatMessageA
lstrlenW
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetNumberFormatW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FindFirstFileW
GetFileAttributesW
GetPrivateProfileStringW
FreeLibrary
ExitProcess
ReadFile
MultiByteToWideChar
FindClose
FindNextFileW
EnterCriticalSection
LeaveCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
GetCurrentThread
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
CreateThread
GetExitCodeThread
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
SetLastError
GetVersionExW
GetFileSizeEx
LoadLibraryW
GetTickCount
MulDiv
GlobalAddAtomW
GlobalAlloc
GlobalUnlock
GlobalLock
GetPrivateProfileIntW
GetFileTime
InitializeCriticalSectionEx
DeleteCriticalSection
GetCurrentThreadId
DeleteFileW
GetTempFileNameW
GetTempPathW
GetThreadId
FormatMessageW
GetCommandLineW
GetFileType
LocalAlloc
TerminateThread
GlobalReAlloc
Module32FirstW
Module32NextW
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
IsBadStringPtrW
OpenEventW
VerifyVersionInfoW
GetEnvironmentVariableW
ReadProcessMemory
lstrcmpiW
GetSystemDirectoryW
SearchPathW
SetFilePointer
GetCurrentProcessId
IsProcessorFeaturePresent
VirtualQueryEx
OpenThread
ResumeThread
GetThreadContext
Thread32First
Thread32Next
QueryPerformanceCounter
QueryPerformanceFrequency
ResetEvent
IsBadReadPtr
TerminateProcess
SetPriorityClass
ProcessIdToSessionId
GetProcessId
GlobalMemoryStatusEx
GetLogicalProcessorInformation
SetProcessWorkingSetSize
GlobalFree
PulseEvent
GetComputerNameW
WTSGetActiveConsoleSessionId
GetCurrentDirectoryW
GetDriveTypeW
OutputDebugStringW
DuplicateHandle
DeviceIoControl
VirtualAlloc
VirtualFree
GetProcessWorkingSetSize
TrySubmitThreadpoolCallback
IsProcessInJob
CreateJobObjectW
QueryInformationJobObject
GetThreadGroupAffinity
SetThreadGroupAffinity
GlobalMemoryStatus
GetProcessAffinityMask
SetProcessAffinityMask
GetActiveProcessorGroupCount
GetActiveProcessorCount
WideCharToMultiByte
K32GetModuleFileNameExW
K32GetMappedFileNameW
K32QueryWorkingSet
DecodePointer
GetStartupInfoW
GetThreadIdealProcessorEx
GetTickCount64
QueryThreadCycleTime
SystemTimeToTzSpecificLocalTime
GetNativeSystemInfo
GetConsoleCP
LCMapStringEx
GetStringTypeW
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
LoadLibraryExA
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
GetSystemInfo
VirtualProtect
VirtualQuery
CompareStringW
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetConsoleMode
ReadConsoleInputW
GetFileSize
FileTimeToLocalFileTime
CreateFileW
ExpandEnvironmentStringsW
SetEnvironmentVariableW
GetStdHandle
TlsGetValue
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TlsFree
FreeLibraryAndExitThread
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
SetEndOfFile
WriteConsoleW
GetFullPathNameW
RaiseException
GetModuleHandleExW
LoadLibraryExW

user32

CheckDlgButton
IsDlgButtonChecked
EnableWindow
ModifyMenuW
TrackPopupMenu
SetMenuInfo
InvalidateRgn
EnumWindows
CopyAcceleratorTableW
TranslateAcceleratorW
DrawMenuBar
IsDialogMessageW
GetMenuBarInfo
ShowWindowAsync
IsIconic
EndTask
RegisterWindowMessageW
GetMessageW
TranslateMessage
DispatchMessageW
ExitWindowsEx
SetLayeredWindowAttributes
CreateDialogParamW
GetDlgItemTextW
CreateMenu
GetMenuInfo
EndMenu
LoadIconW
LockWorkStation
IsHungAppWindow
SendMessageTimeoutW
SetDlgItemInt
CheckRadioButton
MsgWaitForMultipleObjects
GetGuiResources
CharNextW
GetWindowPlacement
MonitorFromPoint
CheckMenuRadioItem
GetWindow
GetDesktopWindow
SetRectEmpty
WindowFromPoint
ClientToScreen
SetCursorPos
MessageBeep
AdjustWindowRectEx
AllowSetForegroundWindow
SetMenuDefaultItem
GetMenuItemInfoW
TrackPopupMenuEx
RemoveMenu
AppendMenuW
GetMenuItemCount
GetMenuItemID
EnableMenuItem
CreatePopupMenu
GetMenuStringW
LoadMenuW
LoadAcceleratorsW
GetDlgCtrlID
SetWindowPlacement
IsWindow
PostQuitMessage
GetMessagePos
PeekMessageW
DrawEdge
TrackMouseEvent
LoadStringA
DefMDIChildProcW
DefFrameProcW
DefDlgProcW
CreateIconIndirect
DestroyWindow
EnumChildWindows
UnionRect
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DrawFrameControl
DialogBoxParamW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
GetAncestor
GetWindowModuleFileNameW
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetClassNameW
SetClassLongW
PtInRect
FrameRect
DrawFocusRect
ScreenToClient
ShowScrollBar
SetScrollPos
RedrawWindow
GetWindowDC
IsWindowEnabled
IsZoomed
IsWindowVisible
MoveWindow
IsChild
GetSysColorBrush
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
KillTimer
GetClassInfoExW
UnregisterClassW
DrawIconEx
GetSysColor
SetMenuItemInfoW
DestroyMenu
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
GetScrollInfo
SetScrollInfo
GetClassLongW
SetWindowLongW
GetWindowLongW
OffsetRect
IntersectRect
InflateRect
CopyRect
SetRect
FillRect
MapWindowPoints
GetCursorPos
SendMessageW
WaitForInputIdle
ShowWindow
SetFocus
GetSystemMetrics
GetMenu
CheckMenuItem
GetSubMenu
InsertMenuW
DeleteMenu
SetForegroundWindow
GetWindowRect
GetClientRect
GetPropW
SetPropW
ScrollWindowEx
ValidateRect
InvalidateRect
EndPaint
UpdateWindow
DrawTextW
SetTimer
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetFocus
SetWindowPos
CreateWindowExW
RegisterClassExW
MessageBoxW
SetCursor
FindWindowW
FindWindowExW
GetWindowThreadProcessId
LoadCursorW
DestroyIcon
LoadImageW
EnumDisplaySettingsW
GetDC
ReleaseDC
LoadStringW
PostMessageW
SetDlgItemTextW
GetParent
DefWindowProcW
CallWindowProcW
BeginPaint

advapi32

AdjustTokenPrivileges
AllocateAndInitializeSid
DuplicateTokenEx
EqualSid
FreeSid
GetTokenInformation
ImpersonateLoggedOnUser
CreateRestrictedToken
GetAce
GetSidIdentifierAuthority
RevertToSelf
GetSidSubAuthority
GetSidSubAuthorityCount
InitializeAcl
IsValidSid
SetTokenInformation
GetSecurityInfo
SetSecurityInfo
LookupAccountSidW
LookupAccountNameW
LsaFreeMemory
LsaClose
LsaOpenPolicy
LsaEnumerateAccountRights
ConvertSidToStringSidW
FlushTraceW
RegConnectRegistryW
CreateProcessAsUserW
GetKernelObjectSecurity
OpenProcessToken
LookupPrivilegeNameW
EnumServicesStatusExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
SetSecurityDescriptorOwner
RegEnumKeyExW
SetEntriesInAclW
AddAccessAllowedAce
QueryServiceConfigW
GetLengthSid
CopySid
CloseTrace
ProcessTrace
OpenTraceW
ControlTraceW
StartTraceW
SetServiceObjectSecurity
QueryServiceObjectSecurity
LookupPrivilegeValueW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyW
RegEnumValueW
MapGenericMask
RegGetValueW
RegCreateKeyW
StartServiceW
QueryServiceStatus
ControlService
QueryServiceConfig2W
SetKernelObjectSecurity
RegCloseKey
OpenServiceW
OpenSCManagerW
RegLoadKeyW
RegOpenKeyW
RegOpenKeyExW
GetServiceDisplayNameW
CloseServiceHandle
RegDeleteValueW
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegQueryValueW
RegUnLoadKeyW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
AddAce

shell32

Shell_NotifyIconW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW
ExtractAssociatedIconW
ShellExecuteW
SHBrowseForFolderW
ExtractIconExW
SHGetStockIconInfo
SHGetFolderPathW
SHGetFileInfoW

ole32

CoCreateInstance
CoUninitialize
CoTaskMemFree
CoMarshalInterThreadInterfaceInStream
CoInitializeEx
CoSetProxyBlanket
CoInitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoGetInterfaceAndReleaseStream

oleaut32

SafeArrayGetElement
VarUI4FromStr
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetLBound
SysAllocString
SysFreeString
SysStringLen
SysAllocStringByteLen
VariantInit
VariantClear
VariantChangeType
SafeArrayGetUBound
SafeArrayDestroy

msimg32

GradientFill

dwmapi

DwmDefWindowProc
DwmSetWindowAttribute

winhttp

WinHttpOpen
WinHttpOpenRequest
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpGetProxyForUrl
WinHttpQueryDataAvailable
WinHttpWriteData
WinHttpReadData
WinHttpConnect
WinHttpSetOption

Sections

.text
Size: 997KB - Virtual size: 996KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 226KB - Virtual size: 225KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 244KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/SysinternalsSuite/procexp64.exe
.exe windows:6 windows x64 arch:x64

74a352b7be38be736b4f1e0d51b66e8c

Code Sign

33:00:00:03:4e:b5:3c:7a:c1:84:6f:eb:2b:00:00:00:00:03:4e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/03/2023, 18:43

Not After

14/03/2024, 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

af:a1:e1:41:b8:6b:ef:58:8b:55:e3:77:a4:6d:6b:12:a6:cd:e8:f0:90:c3:13:1a:0e:a2:a2:30:79:82:2c:9a
Signer

Actual PE Digest

af:a1:e1:41:b8:6b:ef:58:8b:55:e3:77:a4:6d:6b:12:a6:cd:e8:f0:90:c3:13:1a:0e:a2:a2:30:79:82:2c:9a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\1\s\exe\x64\Release\procexp64.pdb

Imports

shlwapi

PathIsNetworkPathW
StrCmpIW
SHAutoComplete
ColorHLSToRGB
ColorRGBToHLS
StrStrIW
ord176
UrlUnescapeW

iphlpapi

GetExtendedTcpTable
GetExtendedUdpTable

ws2_32

WSAStartup
ntohs
ntohl
gethostbyaddr
htons
htonl
getservbyport

mpr

WNetGetConnectionW

comctl32

ImageList_ReplaceIcon
ImageList_Add
InitCommonControlsEx
ImageList_Destroy
ImageList_DrawEx
ImageList_GetIconSize
ImageList_Create
ImageList_AddMasked
ImageList_BeginDrag
ImageList_EndDrag
ImageList_DragEnter
ImageList_DragLeave
ImageList_DragMove
CreateStatusWindowW
ImageList_DragShowNolock
ord17
PropertySheetW
ord413
CreatePropertySheetPageW
ImageList_GetIcon
ord410

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

credui

CredUIPromptForCredentialsW

setupapi

SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

crypt32

CertGetNameStringW
CertDuplicateCertificateContext

aclui

ord1

powrprof

SetSuspendState
IsPwrSuspendAllowed
IsPwrHibernateAllowed

wtsapi32

WTSLogoffSession
WTSFreeMemory
WTSEnumerateSessionsW
WTSQuerySessionInformationW
WTSDisconnectSession
WTSSendMessageW

uxtheme

OpenThemeData
CloseThemeData
DrawThemeBackground
GetThemePartSize
SetWindowTheme
EnableThemeDialogTexture

ntdll

NtQuerySymbolicLinkObject
NtQueryObject
NtOpenSymbolicLinkObject
NtQuerySystemInformation
NtSetInformationProcess
VerSetConditionMask
NtLoadDriver
NtCreateKey
NtOpenKey
NtQuerySemaphore
NtSuspendThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwind
RtlPcToFileHeader
RtlUnwindEx
NtResumeThread
NtResumeProcess
NtOpenThread
RtlCreateQueryDebugBuffer
RtlQueryProcessDebugInformation
RtlDestroyQueryDebugBuffer
NtQueryEvent
NtQueryInformationThread
NtQuerySection
NtQueryInformationProcess
NtQueryMutant
NtSuspendProcess
RtlVirtualUnwind

gdi32

CreateSolidBrush
DeleteDC
GetBkColor
GetBkMode
GetDeviceCaps
GetStockObject
CreateRectRgnIndirect
RectInRegion
SelectClipRgn
SelectObject
SetBkColor
SetDCPenColor
SetBkMode
SetTextColor
GetTextMetricsW
MoveToEx
Polyline
ExtTextOutW
SetViewportOrgEx
CreateFontIndirectW
GetTextExtentPoint32W
Rectangle
SetTextAlign
TextOutW
SetMapMode
StartDocW
EndDoc
StartPage
EndPage
CreateBitmap
CreatePatternBrush
ExcludeClipRect
GetCurrentObject
PatBlt
Polygon
GetTextExtentExPointW
RestoreDC
SaveDC
SetROP2
CreatePen
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
DeleteObject
GetObjectW
CreateDIBSection
LineTo

comdlg32

PrintDlgW
ChooseFontW
CommDlgExtendedError
GetOpenFileNameW
GetSaveFileNameW
ChooseColorW
FindTextW

kernel32

FileTimeToLocalFileTime
GetFileSize
GetFileTime
GetFullPathNameW
GetLongPathNameW
WriteFile
CloseHandle
GetLastError
SetErrorMode
InitializeCriticalSection
Sleep
GetCurrentProcess
ExitThread
TlsAlloc
TlsSetValue
CreateProcessW
OpenProcess
GetVersion
GetSystemWindowsDirectoryW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
IsWow64Process
GetSystemWow64DirectoryW
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LocalFree
FormatMessageA
lstrlenW
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
GetLocaleInfoW
GetNumberFormatW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
FindFirstFileW
GetFileAttributesW
VirtualQuery
FreeLibrary
LoadLibraryExW
ReadFile
MultiByteToWideChar
FindClose
FindNextFileW
EnterCriticalSection
LeaveCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
WaitForMultipleObjects
GetCurrentThread
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
CreateThread
GetExitCodeThread
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
SetLastError
GetVersionExW
GetFileSizeEx
LoadLibraryW
GetTickCount
MulDiv
GlobalAddAtomW
GlobalAlloc
GlobalUnlock
ExpandEnvironmentStringsW
GetPrivateProfileIntW
RaiseException
InitializeCriticalSectionEx
DeleteCriticalSection
GetCurrentThreadId
DeleteFileW
GetTempFileNameW
GetTempPathW
GetThreadId
FormatMessageW
GetCommandLineW
GetFileType
LocalAlloc
TerminateThread
GlobalReAlloc
Module32FirstW
Module32NextW
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
IsBadStringPtrW
OpenEventW
VerifyVersionInfoW
GetEnvironmentVariableW
ReadProcessMemory
lstrcmpiW
GetSystemDirectoryW
SearchPathW
SetFilePointer
GetCurrentProcessId
VirtualQueryEx
OpenThread
SuspendThread
ResumeThread
GetThreadContext
Thread32First
Thread32Next
QueryPerformanceCounter
QueryPerformanceFrequency
ResetEvent
IsBadReadPtr
TerminateProcess
SetPriorityClass
ProcessIdToSessionId
GetProcessId
GlobalMemoryStatusEx
GetLogicalProcessorInformation
SetProcessWorkingSetSize
GlobalFree
PulseEvent
GetComputerNameW
WTSGetActiveConsoleSessionId
GetCurrentDirectoryW
GetDriveTypeW
OutputDebugStringW
DuplicateHandle
DeviceIoControl
VirtualAlloc
VirtualFree
GetProcessWorkingSetSize
TrySubmitThreadpoolCallback
IsProcessInJob
CreateJobObjectW
QueryInformationJobObject
GetThreadGroupAffinity
SetThreadGroupAffinity
GlobalMemoryStatus
GetProcessAffinityMask
SetProcessAffinityMask
GetActiveProcessorGroupCount
GetActiveProcessorCount
WideCharToMultiByte
K32GetModuleFileNameExW
K32GetMappedFileNameW
K32QueryWorkingSet
DecodePointer
GetStartupInfoW
GetThreadIdealProcessorEx
GetTickCount64
QueryThreadCycleTime
SystemTimeToTzSpecificLocalTime
GetNativeSystemInfo
CompareStringW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
LCMapStringEx
GetStringTypeW
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
LoadLibraryExA
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
EncodePointer
IsDebuggerPresent
LCMapStringW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
SetConsoleMode
ReadConsoleInputW
SetEnvironmentVariableW
GetStdHandle
TlsGetValue
ReadConsoleW
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetCPInfo
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
TlsFree
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetConsoleCP
GetSystemInfo
GetOEMCP
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
SetEndOfFile
WriteConsoleW
CreateFileW
GlobalLock
VirtualProtect
GetPrivateProfileStringW

user32

GetDesktopWindow
GetWindow
CheckMenuRadioItem
MonitorFromPoint
GetWindowPlacement
CheckDlgButton
IsDlgButtonChecked
EnableWindow
ModifyMenuW
TrackPopupMenu
SetMenuInfo
InvalidateRgn
SetClassLongW
EnumWindows
CopyAcceleratorTableW
TranslateAcceleratorW
DrawMenuBar
IsDialogMessageW
GetMenuBarInfo
ShowWindowAsync
IsIconic
EndTask
RegisterWindowMessageW
GetMessageW
TranslateMessage
DispatchMessageW
ExitWindowsEx
SetLayeredWindowAttributes
CreateDialogParamW
GetDlgItemTextW
CreateMenu
GetMenuInfo
EndMenu
LoadIconW
LockWorkStation
IsHungAppWindow
SendMessageTimeoutW
SetDlgItemInt
CheckRadioButton
MsgWaitForMultipleObjects
GetGuiResources
CharNextW
SetRectEmpty
WindowFromPoint
ClientToScreen
SetCursorPos
MessageBeep
AdjustWindowRectEx
AllowSetForegroundWindow
SetMenuDefaultItem
GetMenuItemInfoW
TrackPopupMenuEx
RemoveMenu
AppendMenuW
GetMenuItemCount
GetMenuItemID
EnableMenuItem
CreatePopupMenu
GetMenuStringW
LoadMenuW
LoadAcceleratorsW
GetDlgCtrlID
SetWindowPlacement
IsWindow
PostQuitMessage
GetMessagePos
PeekMessageW
DrawEdge
TrackMouseEvent
LoadStringA
DefMDIChildProcW
DefFrameProcW
DefDlgProcW
CreateIconIndirect
DestroyWindow
EnumChildWindows
UnionRect
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
DrawFrameControl
DialogBoxParamW
GetDlgItem
EndDialog
DialogBoxIndirectParamW
GetAncestor
GetWindowModuleFileNameW
GetMonitorInfoW
MonitorFromWindow
SystemParametersInfoW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetClassNameW
SetClassLongPtrW
SetWindowLongW
GetWindowLongW
PtInRect
FrameRect
DrawFocusRect
ScreenToClient
ShowScrollBar
SetScrollPos
RedrawWindow
GetWindowDC
IsWindowEnabled
IsZoomed
IsWindowVisible
MoveWindow
IsChild
GetSysColorBrush
GetWindowTextLengthW
GetWindowTextW
SetWindowTextW
KillTimer
GetClassInfoExW
UnregisterClassW
DrawIconEx
GetSysColor
SetMenuItemInfoW
DestroyMenu
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
GetScrollInfo
SetScrollInfo
GetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
OffsetRect
IntersectRect
InflateRect
CopyRect
SetRect
FillRect
MapWindowPoints
SendMessageW
WaitForInputIdle
ShowWindow
SetFocus
GetSystemMetrics
GetMenu
CheckMenuItem
GetSubMenu
InsertMenuW
DeleteMenu
SetForegroundWindow
GetCursorPos
GetWindowRect
GetClientRect
GetPropW
SetPropW
ScrollWindowEx
InvalidateRect
EndPaint
BeginPaint
UpdateWindow
DrawTextW
SetTimer
ReleaseCapture
SetCapture
GetCapture
GetKeyState
GetFocus
SetWindowPos
CreateWindowExW
MessageBoxW
SetCursor
FindWindowW
FindWindowExW
GetWindowThreadProcessId
LoadCursorW
DestroyIcon
LoadImageW
EnumDisplaySettingsW
GetDC
ReleaseDC
LoadStringW
PostMessageW
SetDlgItemTextW
GetParent
DefWindowProcW
CallWindowProcW
RegisterClassExW
ValidateRect

advapi32

AdjustTokenPrivileges
AllocateAndInitializeSid
DuplicateTokenEx
EqualSid
FreeSid
GetTokenInformation
ImpersonateLoggedOnUser
CreateRestrictedToken
GetAce
GetSidIdentifierAuthority
RevertToSelf
GetSidSubAuthority
GetSidSubAuthorityCount
InitializeAcl
IsValidSid
SetTokenInformation
GetSecurityInfo
SetSecurityInfo
LookupAccountSidW
LookupAccountNameW
LsaFreeMemory
LsaClose
LsaOpenPolicy
LsaEnumerateAccountRights
ConvertSidToStringSidW
FlushTraceW
RegConnectRegistryW
CreateProcessAsUserW
GetKernelObjectSecurity
OpenProcessToken
LookupPrivilegeNameW
EnumServicesStatusExW
RegEnumKeyExW
AddAccessAllowedAce
QueryServiceConfigW
GetLengthSid
CopySid
CloseTrace
ProcessTrace
OpenTraceW
ControlTraceW
StartTraceW
SetServiceObjectSecurity
QueryServiceObjectSecurity
MapGenericMask
RegGetValueW
RegCreateKeyW
StartServiceW
LookupPrivilegeValueW
RegCreateKeyExW
RegDeleteKeyW
RegEnumKeyW
RegEnumValueW
QueryServiceStatus
ControlService
QueryServiceConfig2W
OpenServiceW
OpenSCManagerW
GetServiceDisplayNameW
CloseServiceHandle
SetKernelObjectSecurity
RegCloseKey
RegDeleteValueW
CryptDestroyHash
RegLoadKeyW
RegOpenKeyW
RegOpenKeyExW
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
RegQueryValueW
RegUnLoadKeyW
RegSetValueExW
RegQueryValueExW
RegQueryInfoKeyW
AddAce

shell32

Shell_NotifyIconW
SHGetMalloc
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ShellExecuteExW
ExtractAssociatedIconW
ShellExecuteW
SHBrowseForFolderW
ExtractIconExW
SHGetStockIconInfo
SHGetFolderPathW
SHGetFileInfoW

ole32

CoCreateInstance
CoUninitialize
CoTaskMemFree
CoMarshalInterThreadInterfaceInStream
CoInitializeEx
CoSetProxyBlanket
CoInitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoGetInterfaceAndReleaseStream

oleaut32

SafeArrayGetElement
VarUI4FromStr
SysAllocStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetLBound
SysAllocString
SysFreeString
SysStringLen
SysAllocStringByteLen
VariantInit
SafeArrayGetUBound
VariantClear
VariantChangeType
SafeArrayDestroy

msimg32

GradientFill

dwmapi

DwmDefWindowProc
DwmSetWindowAttribute

winhttp

WinHttpQueryDataAvailable
WinHttpWriteData
WinHttpReadData
WinHttpConnect
WinHttpCloseHandle
WinHttpOpen
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetOption
WinHttpOpenRequest
WinHttpGetProxyForUrl

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 306KB - Virtual size: 305KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 53KB - Virtual size: 259KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 792KB - Virtual size: 791KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Bin/GenPat.exe
.exe windows:4 windows x86 arch:x86

f905cee6109ef38cf044000338622678

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

zlib1

adler32

msvcrt

_except_handler3
_controlfp
fseek
??3@YAXPAX@Z
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__p___winitenv
exit
_XcptFilter
_exit
??1type_info@@UAE@XZ
_onexit
__dllonexit
wcslen
_wunlink
ftell
fwrite
??2@YAPAXI@Z
_CxxThrowException
_assert
_wfopen
__CxxFrameHandler
fclose
fread

msvcp60

??0Init@ios_base@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
??1Init@ios_base@std@@QAE@XZ
?_Fpz@std@@3_JB
??0_Lockit@std@@QAE@XZ
??1_Lockit@std@@QAE@XZ
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_Freeze@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
??0?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@1@H@Z
??5?$basic_istream@GU?$char_traits@G@std@@@std@@QAEAAV01@AAH@Z
??_D?$basic_istringstream@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEXXZ
?wcerr@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A
??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@ABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@H@Z
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??6std@@YAAAV?$basic_ostream@GU?$char_traits@G@std@@@0@AAV10@PBG@Z
??0_Winit@std@@QAE@XZ
?wcout@std@@3V?$basic_ostream@GU?$char_traits@G@std@@@1@A
??6?$basic_ostream@GU?$char_traits@G@std@@@std@@QAEAAV01@I@Z

kernel32

GetTempFileNameW
GetSystemTimeAsFileTime
CreateFileW
GetFileTime
CloseHandle

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
plugins/nsis/Bin/MakeLangId.exe
.exe windows:4 windows x86 arch:x86

0f0328a25eafdf0478cb2d380f3cc3a4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

EnumSystemLocalesW
ExitProcess
GetLocaleInfoW
lstrcmpW

user32

EndDialog
SendMessageW
wsprintfW
PostMessageW
SetDlgItemTextW
EnableWindow
DialogBoxParamW
LoadImageW
ShowWindow
GetDlgItem

comctl32

ord17

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
plugins/nsis/Bin/RegTool-x86.bin
.exe windows:4 windows x86 arch:x86

27d8026158a35d76c6ebc7f508d083b2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCloseKey
RegEnumKeyA
RegQueryValueExA
RegOpenKeyExA
RegDeleteKeyA

oleaut32

RegisterTypeLi
LoadTypeLi

ole32

OleInitialize
OleUninitialize

user32

wsprintfA
CharNextW
CharNextA

kernel32

GlobalFree
CloseHandle
GetFileSize
GetFileAttributesA
CreateFileA
lstrcpyA
GetShortPathNameA
GetWindowsDirectoryA
lstrcatA
GetProcAddress
LoadLibraryA
lstrcmpiA
lstrlenA
ExitProcess
SetErrorMode
ReadFile
GetModuleFileNameA
GlobalAlloc
GetCommandLineA
FreeLibrary
WaitForSingleObject
CreateProcessA
GetSystemDirectoryA
MoveFileExA
LoadLibraryExA
MultiByteToWideChar
WriteFile
SetFilePointer

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
plugins/nsis/Bin/makensis.exe
.exe windows:4 windows x86 arch:x86

2ef325d0a91ab4fe389a1a08c72662ff

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

CreateFontIndirectW
DeleteObject
GetTextExtentPoint32W
SelectObject
DeleteDC
CreateCompatibleDC
GetObjectW

user32

CharPrevW
MapDialogRect
CreateDialogIndirectParamW
GetDC
GetMessageW
wsprintfW
CharNextW
SendMessageW
DispatchMessageW
IsWindow
CreateWindowExW
DestroyWindow
GetWindowLongW
PostMessageW
SetWindowLongW

shlwapi

PathRemoveFileSpecW

oleaut32

LoadTypeLi

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

shell32

ShellExecuteW

zlib1

deflate
deflateEnd
deflateInit2_

msvcp60

??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@0@Z
??1bad_alloc@std@@UAE@XZ
??_7bad_alloc@std@@6B@
?_Copy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
?_Xlen@std@@YAXXZ
?max_size@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIXZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??8std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??0bad_alloc@std@@QAE@ABV01@@Z
??0bad_alloc@std@@QAE@PBD@Z
??Mstd@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??9std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z
??1out_of_range@std@@UAE@XZ
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@PBG@Z
?erase@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@II@Z
?substr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBE?AV12@II@Z
?rfind@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@0@Z
??Y?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??8std@@YA_NABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBG@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@PBGABV?$allocator@G@1@@Z
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@PBG@Z
??0runtime_error@std@@QAE@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBDABV?$allocator@D@1@@Z
?c_str@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEPBGXZ
??4?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV01@ABV01@@Z
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV?$allocator@G@1@@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?insert@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IPBGI@Z
?find@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QBEIPBGII@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@PBGABV10@@Z
??9std@@YA_NPBGABV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@@Z
?replace@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@IIPBGI@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
??_7out_of_range@std@@6B@
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
??0out_of_range@std@@QAE@ABV01@@Z
??0logic_error@std@@QAE@ABV01@@Z
?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB
?npos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@2IB
?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?append@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??_7runtime_error@std@@6B@
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1runtime_error@std@@UAE@XZ
??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@XZ
??0runtime_error@std@@QAE@ABV01@@Z
?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z
??0_Lockit@std@@QAE@XZ
??0?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE@ABV01@@Z
??Hstd@@YA?AV?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@0@ABV10@G@Z
??1_Lockit@std@@QAE@XZ

msvcrt

_errno
_assert
exit
swprintf
wcscpy
wcsncmp
wcscmp
_ftol
tolower
fsetpos
fgetpos
qsort
wcsrchr
wcstoul
wcstol
_iob
_wtol
signal
fgetwc
raise
_wchdir
wcsncpy
_snwprintf
wcscat
towupper
swscanf
localtime
time
_wunlink
wcsftime
mktime
gmtime
ungetc
fgetc
rewind
_setmode
atof
_wfopen
_filelengthi64
towlower
_vsnwprintf
malloc
_get_osfhandle
vfwprintf
_except_handler3
?terminate@@YAXXZ
??1type_info@@UAE@XZ
__dllonexit
_onexit
_exit
_XcptFilter
__p___winitenv
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
fwrite
ftell
fclose
fseek
fread
_wtoi
_wcsicmp
_wcsnicmp
wcsstr
_wcsdup
wcschr
free
realloc
_CxxThrowException
_wgetenv
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
??0exception@@QAE@ABV0@@Z
wcslen
memmove
_purecall
fflush
__CxxFrameHandler
_wremove

kernel32

VirtualFree
VirtualAlloc
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WriteConsoleW
GetConsoleMode
SetFilePointer
GetLastError
GetOEMCP
GetConsoleCP
CreatePipe
CreateProcessW
ReadFile
GetExitCodeProcess
SetConsoleCP
GetModuleFileNameW
IsDBCSLeadByteEx
MultiByteToWideChar
FileTimeToLocalFileTime
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
GetFileSize
GetFileAttributesW
GetFileTime
GetFullPathNameW
UnmapViewOfFile
MapViewOfFile
GetTempPathW
WideCharToMultiByte
CreateEventW
CloseHandle
CreateFileW
ResetEvent
WaitForSingleObject
WaitForMultipleObjects
CreateThread
SetEvent
FindClose
FindNextFileW
GetModuleHandleW
IsValidCodePage
SetPriorityClass
FindFirstFileW
GetConsoleOutputCP
SetThreadPriority
GetCurrentProcess
OpenEventW
GetSystemInfo
SetConsoleOutputCP
GetTempFileNameW
CreateFileMappingW

Sections

.text
Size: 319KB - Virtual size: 318KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 110KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
plugins/nsis/Bin/zip2exe.exe
.exe windows:4 windows x86 arch:x86

d32ef64a44c25be295ce6b4254f31c92

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

zlib1

get_crc_table
inflateEnd
inflate
crc32
inflateInit2_

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

shell32

DragFinish
DragAcceptFiles
ShellExecuteW
DragQueryFileW

comctl32

ord17

comdlg32

GetSaveFileNameW
GetOpenFileNameW

user32

LoadIconW
IsDlgButtonChecked
GetDlgItemTextW
PostMessageW
CheckDlgButton
SetClassLongW
OemToCharBuffA
PeekMessageW
TranslateMessage
DispatchMessageW
MessageBoxW
SendDlgItemMessageW
GetDlgItem
EnableWindow
SetDlgItemTextW
DialogBoxParamW
EndDialog
wsprintfW
SendMessageW
ShowWindow

gdi32

DeleteObject
CreateFontW

msvcrt

towlower
_controlfp
__p__commode
fwrite
wcsstr
wcslen
strlen
fclose
ftell
fseek
_wfopen
wcscat
memmove
strrchr
wcscpy
wcscmp
fwprintf
fread
malloc
free
_exit
_XcptFilter
exit
_wcmdln
__wgetmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__fmode
__set_app_type
_except_handler3

kernel32

GetVersionExW
CreatePipe
GetStartupInfoW
lstrlenW
GetModuleFileNameW
CreateProcessW
GetModuleHandleW
GetLastError
FormatMessageW
LocalFree
ReadFile
GetTickCount
GetTempFileNameW
CreateThread
MultiByteToWideChar
lstrcatW
CreateFileW
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
CloseHandle
lstrcpyW
FindFirstFileW
SetFileAttributesW
DeleteFileW
FindNextFileW
FindClose
RemoveDirectoryW
CreateDirectoryW
GetTempPathW

Sections

.text
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
plugins/nsis/Bin/zlib1.dll
.dll windows:4 windows x86 arch:x86

0424eef96573bc4f65a9625c1dde665f

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

wcstombs
free
malloc
sprintf
strerror
_errno
_wopen
_vsnprintf
_initterm
_adjust_fdiv
memchr
_lseeki64
_open
_read
_close
_write

kernel32

DisableThreadLibraryCalls

Exports

Exports

adler32
adler32_combine
adler32_combine64
compress
compress2
compressBound
crc32
crc32_combine
crc32_combine64
deflate
deflateBound
deflateCopy
deflateEnd
deflateInit2_
deflateInit_
deflateParams
deflatePending
deflatePrime
deflateReset
deflateResetKeep
deflateSetDictionary
deflateSetHeader
deflateTune
get_crc_table
gzbuffer
gzclearerr
gzclose
gzclose_r
gzclose_w
gzdirect
gzdopen
gzeof
gzerror
gzflush
gzgetc
gzgetc_
gzgets
gzoffset
gzoffset64
gzopen
gzopen64
gzopen_w
gzprintf
gzputc
gzputs
gzread
gzrewind
gzseek
gzseek64
gzsetparams
gztell
gztell64
gzungetc
gzwrite
inflate
inflateBack
inflateBackEnd
inflateBackInit_
inflateCopy
inflateEnd
inflateGetHeader
inflateInit2_
inflateInit_
inflateMark
inflatePrime
inflateReset
inflateReset2
inflateResetKeep
inflateSetDictionary
inflateSync
inflateSyncPoint
inflateUndermine
uncompress
zError
zlibCompileFlags
zlibVersion

Sections

.text
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 846B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Include/Colors.nsh
plugins/nsis/Include/FileFunc.nsh
plugins/nsis/Include/InstallOptions.nsh
plugins/nsis/Include/Integration.nsh
plugins/nsis/Include/LangFile.nsh
plugins/nsis/Include/Library.nsh
plugins/nsis/Include/LogicLib.nsh
plugins/nsis/Include/MUI.nsh
plugins/nsis/Include/MUI2.nsh
plugins/nsis/Include/Memento.nsh
.ps1
plugins/nsis/Include/MultiUser.nsh
.ps1
plugins/nsis/Include/Sections.nsh
plugins/nsis/Include/StrFunc.nsh
.ps1
plugins/nsis/Include/TextFunc.nsh
plugins/nsis/Include/UpgradeDLL.nsh
plugins/nsis/Include/Util.nsh
plugins/nsis/Include/VB6RunTime.nsh
plugins/nsis/Include/VPatchLib.nsh
plugins/nsis/Include/Win/COM.nsh
plugins/nsis/Include/Win/Propkey.nsh
plugins/nsis/Include/Win/WinDef.nsh
plugins/nsis/Include/Win/WinError.nsh
plugins/nsis/Include/Win/WinNT.nsh
plugins/nsis/Include/Win/WinUser.nsh
plugins/nsis/Include/WinCore.nsh
plugins/nsis/Include/WinMessages.nsh
plugins/nsis/Include/WinVer.nsh
plugins/nsis/Include/WordFunc.nsh
plugins/nsis/Include/nsDialogs.nsh
.ps1
plugins/nsis/Include/x64.nsh
plugins/nsis/Plugins/x86-ansi/Banner.dll
.dll windows:4 windows x86 arch:x86

f81377f1c55b7962f1e18d52fc7eb628

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
GetModuleHandleA
CloseHandle
Sleep
CreateThread
GetCurrentThreadId
GlobalFree
lstrcmpA
lstrcpynA
GlobalAlloc

user32

DestroyWindow
SetWindowLongA
GetWindowLongA
SetWindowTextA
SetDlgItemTextA
DispatchMessageA
PeekMessageA
WaitMessage
IsWindow
CreateDialogParamA
ShowWindow
AttachThreadInput
IsWindowVisible
wsprintfA
PostMessageA

Exports

Exports

destroy
getWindow
show

Sections

.text
Size: 1024B - Virtual size: 871B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-ansi/BgImage.dll
.dll windows:4 windows x86 arch:x86

bdcecc8b26871abb93996c6c18e09c94

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InitializeCriticalSection
DeleteCriticalSection
lstrlenA
lstrcpyA
lstrcpynA
GlobalFree
lstrcmpiA
EnterCriticalSection
GlobalAlloc
LeaveCriticalSection

user32

UnregisterClassA
CallWindowProcA
LoadImageA
DestroyWindow
BeginPaint
IsWindow
SendMessageA
DefWindowProcA
RedrawWindow
ShowWindow
LoadCursorA
RegisterClassA
CreateWindowExA
SetWindowLongA
GetSystemMetrics
SetWindowPos
DrawTextA
EndPaint
FillRect

gdi32

GetObjectA
DeleteDC
DeleteObject
CreateSolidBrush
CreateCompatibleDC
SelectObject
SetMapMode
GetMapMode
CreateCompatibleBitmap
CreateBitmap
SetBkMode
BitBlt
DPtoLP
SetBkColor
SetTextColor

winmm

PlaySoundA

Exports

Exports

AddImage
AddText
Clear
Destroy
Redraw
SetBg
SetReturn
Sound

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 620B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-ansi/Dialer.dll
.dll windows:4 windows x86 arch:x86

1f1fddd20def884fc86e064d8f2333ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GetSystemDirectoryA
GetProcAddress
lstrcpynA
LoadLibraryA

user32

wsprintfA

Exports

Exports

AttemptConnect
AutodialHangup
AutodialOnline
AutodialUnattended
GetConnectedState

Sections

.text
Size: 1024B - Virtual size: 625B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 439B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 210B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-ansi/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

610235b90207a63ccf481f0d4375d329

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetPrivateProfileIntA
GetCurrentDirectoryA
MultiByteToWideChar
GetPrivateProfileStringA
SetCurrentDirectoryA
GetModuleHandleA
lstrcmpiA
WritePrivateProfileStringA
lstrcatA
lstrcpynA
GlobalFree
lstrlenA
lstrcpyA
GlobalUnlock
GlobalAlloc
GlobalLock

user32

MapWindowPoints
PtInRect
CloseClipboard
LoadCursorA
GetDlgCtrlID
OpenClipboard
GetClientRect
SetWindowRgn
DrawFocusRect
LoadImageA
SetWindowLongA
CreateWindowExA
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamA
ShowWindow
DrawTextA
SetCursor
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
CallWindowProcA
PostMessageA
MessageBoxA
GetSysColor
CharNextA
wsprintfA
GetWindowTextA
SetWindowTextA
SendMessageA
GetWindowLongA
EnableMenuItem
GetSystemMenu
GetClipboardData
LoadIconA

gdi32

DeleteObject
CombineRgn
SetTextColor
GetDIBits
SelectObject
CreateRectRgn
GetObjectA
CreateCompatibleDC

shell32

SHBrowseForFolderA
SHGetPathFromIDListA
ShellExecuteA
SHGetDesktopFolder

comdlg32

GetOpenFileNameA
GetSaveFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
show

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-ansi/LangDLL.dll
.dll windows:4 windows x86 arch:x86

274b99a815ba574d8c9e1712916d8b30

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
GlobalAlloc
lstrcmpA
GetModuleHandleA
lstrlenA
MulDiv
lstrcpynA
GetACP
lstrcpyA

user32

SetDlgItemTextA
SendDlgItemMessageA
EndDialog
DialogBoxParamA
SetWindowTextA
LoadIconA
GetDC
ShowWindow
SendMessageA

gdi32

DeleteObject
CreateFontIndirectA
GetDeviceCaps

Exports

Exports

LangDialog

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 697B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 362B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-ansi/Math.dll
.dll windows:4 windows x86 arch:x86

6a7dba1ca35af83a9a3593fbf002fb1e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapFree
lstrcmpA
lstrlenA
GlobalFree
lstrcatA
GlobalAlloc
lstrcpynA
MultiByteToWideChar
WideCharToMultiByte
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetCommandLineA
GetVersion
RaiseException
GetProcAddress
GetModuleHandleA
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
lstrcpyA
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetCPInfo
GetACP
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
GetLastError
SetFilePointer
HeapAlloc
VirtualAlloc
HeapReAlloc
LCMapStringA
GetStringTypeW
GetOEMCP
LoadLibraryA
GetStringTypeA
FlushFileBuffers
CloseHandle
LCMapStringW
SetStdHandle
RtlUnwind

Exports

Exports

Script

Sections

.text
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-ansi/StartMenu.dll
.dll windows:4 windows x86 arch:x86

17fb6a8708b9c0bb2d5d8687870eb415

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcatA
FindClose
FindNextFileA
lstrcmpA
GetModuleHandleA
lstrcmpiA
MulDiv
lstrcpynA
GlobalAlloc
lstrcpyA
FindFirstFileA
GlobalFree

user32

GetMessageA
TranslateMessage
PostMessageA
DispatchMessageA
GetDlgItem
GetWindowLongA
CheckDlgButton
ShowWindow
LoadIconA
GetClientRect
MoveWindow
DestroyWindow
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextA
SendMessageA
IsDlgButtonChecked
GetWindowTextA
CreateDialogParamA
SetWindowLongA
wsprintfA
ScreenToClient
IsDialogMessageA
CallWindowProcA

gdi32

GetTextMetricsA
SelectObject

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListA

ole32

CoTaskMemFree

Exports

Exports

Init
Select
Show

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-ansi/System.dll
.dll windows:4 windows x86 arch:x86

8c8a576201f68de1a3f26fc723b9f30f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

MultiByteToWideChar
GlobalFree
GlobalSize
lstrcpynA
lstrcpyA
GetProcAddress
VirtualFree
FreeLibrary
lstrlenA
LoadLibraryA
GetModuleHandleA
GlobalAlloc
WideCharToMultiByte
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfA

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 654B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-ansi/TypeLib.dll
.dll windows:4 windows x86 arch:x86

895f9fb5df59a121c70c4cba37753299

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
lstrcpynA
GlobalAlloc
MultiByteToWideChar
GlobalFree

user32

wsprintfA

oleaut32

LoadTypeLibEx
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi

Exports

Exports

GetLibVersion
Register
UnRegister

Sections

.text
Size: 1024B - Virtual size: 644B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 174B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-ansi/UserInfo.dll
.dll windows:4 windows x86 arch:x86

d576645bcd8a66d2fe678a075f4cc6e0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
GetUserNameA

kernel32

GlobalFree
GetVersion
GlobalAlloc
CloseHandle
GetModuleHandleA
GetLastError
GetCurrentProcess
GetCurrentThread
GetProcAddress
lstrcpynA

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 711B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 705B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-ansi/VPatch.dll
.dll windows:4 windows x86 arch:x86

7894c75fe59c05f9ef529bd35068b5f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
WriteFile
GetSystemTimeAsFileTime
ReadFile
SetFilePointer
DeleteFileA
CloseHandle
CreateFileA
SetFileTime
lstrcpyA
lstrcpynA
GlobalAlloc

Exports

Exports

GetFileCRC32
GetFileMD5
vpatchfile

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 366B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-ansi/advsplash.dll
.dll windows:4 windows x86 arch:x86

c0d4e5fadc92d88e6603d2d1c1d8421c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpynA
LoadLibraryA
lstrcpyA
lstrcatA
GetProcAddress
GlobalAlloc
GlobalFree

user32

EnumDisplaySettingsA
LoadImageA
BeginPaint
SetWindowLongA
SystemParametersInfoA
EndPaint
GetClientRect
CreateWindowExA
DefWindowProcA
DestroyWindow
IsWindow
GetMessageA
DispatchMessageA
UnregisterClassA
wsprintfA
PostMessageA
SetWindowRgn
RegisterClassA
LoadCursorA
SetWindowPos

gdi32

BitBlt
DeleteDC
DeleteObject
CombineRgn
GetObjectA
GetDIBits
SelectObject
CreateCompatibleDC
CreateRectRgn

winmm

timeSetEvent
PlaySoundA
timeKillEvent

Exports

Exports

show

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-ansi/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

ebc2d915841be8afc8fa1ee9f6850960

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesA
lstrcpyA
MulDiv
lstrlenA
HeapFree
GetCurrentDirectoryA
lstrcmpiA
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynA
GlobalAlloc
SetCurrentDirectoryA
HeapAlloc

user32

DestroyWindow
CallWindowProcA
SetCursor
LoadCursorA
GetPropA
CharPrevA
DrawFocusRect
GetWindowLongA
DrawTextA
GetClientRect
SetWindowLongA
GetDlgItem
GetSysColor
SetWindowPos
CreateDialogParamA
MapDialogRect
GetWindowRect
SetPropA
CreateWindowExA
IsWindow
SetTimer
KillTimer
DispatchMessageA
TranslateMessage
GetMessageA
IsDialogMessageA
ShowWindow
wsprintfA
CharNextA
SendMessageA
MapWindowPoints
RemovePropA
GetWindowTextA

gdi32

SetTextColor

shell32

SHBrowseForFolderA
SHGetPathFromIDListA

comdlg32

GetSaveFileNameA
GetOpenFileNameA
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 628B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-ansi/nsExec.dll
.dll windows:4 windows x86 arch:x86

e269b6260a93a17ceff5184b3982ded8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl

user32

wsprintfA
SendMessageA
CharNextA
OemToCharBuffA
FindWindowExA
CharNextExA
CharPrevA

kernel32

GetVersion
lstrcmpiA
lstrlenA
lstrcpynA
ExitProcess
Sleep
TerminateProcess
GlobalReAlloc
ReadFile
PeekNamedPipe
GetExitCodeProcess
WaitForSingleObject
GetTickCount
lstrcpyA
CreateProcessA
GetStartupInfoA
CreatePipe
CreateFileA
DeleteFileA
CopyFileA
GetCommandLineA
lstrcatA
CloseHandle
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
GlobalAlloc
GetTempFileNameA
GlobalFree
GetModuleHandleA
GetModuleFileNameA
GetProcAddress
GetCurrentProcess

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 434B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-ansi/nsisdl.dll
.dll windows:4 windows x86 arch:x86

b6f6870d99a0ce8a15a0289401980ed7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

wsock32

__WSAFDIsSet
WSAStartup
WSACleanup
send
WSAGetLastError
recv
select
connect
shutdown
closesocket
socket
htons
inet_ntoa
ioctlsocket
gethostbyname

user32

CreateWindowExA
SetDlgItemTextA
CharPrevA
SetWindowLongA
RegisterWindowMessageA
CallWindowProcA
DestroyWindow
SendMessageA
GetWindowLongA
SetWindowTextA
GetWindowRect
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExA
wsprintfA
EnableWindow

kernel32

CreateFileA
WriteFile
Sleep
DeleteFileA
GetTickCount
MulDiv
GlobalFree
GlobalAlloc
lstrcatA
lstrlenA
lstrcpynA
WaitForSingleObject
CloseHandle
CreateThread
lstrcpyA
lstrcmpiA

Exports

Exports

download
download_quiet

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-ansi/splash.dll
.dll windows:4 windows x86 arch:x86

68076cb273e921c026729fab6f5e6234

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
lstrcpynA
lstrcpyA
lstrcatA

user32

RegisterClassA
LoadImageA
CreateWindowExA
SetTimer
EndPaint
GetClientRect
BeginPaint
IsWindow
ShowWindow
SetWindowPos
SetWindowLongA
SystemParametersInfoA
GetMessageA
DispatchMessageA
UnregisterClassA
wsprintfA
LoadCursorA
DefWindowProcA
DestroyWindow

gdi32

GetObjectA
CreateCompatibleDC
DeleteDC
BitBlt
SelectObject
DeleteObject

winmm

PlaySoundA

Exports

Exports

show

Sections

.text
Size: 1024B - Virtual size: 955B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 962B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 92B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-unicode/Banner.dll
.dll windows:4 windows x86 arch:x86

767a5b32183c6c4ff645882480adc9a6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyW
GetModuleHandleW
CloseHandle
Sleep
CreateThread
GetCurrentThreadId
GlobalFree
lstrcmpW
lstrcpynW
GlobalAlloc

user32

DestroyWindow
SetWindowLongW
GetWindowLongW
SetWindowTextW
SetDlgItemTextW
DispatchMessageW
PeekMessageW
WaitMessage
IsWindow
CreateDialogParamW
ShowWindow
AttachThreadInput
IsWindowVisible
wsprintfW
PostMessageW

Exports

Exports

destroy
getWindow
show

Sections

.text
Size: 1024B - Virtual size: 874B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-unicode/BgImage.dll
.dll windows:4 windows x86 arch:x86

32b0f5880a0efd258c6be2f7a14f4a9f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InitializeCriticalSection
DeleteCriticalSection
lstrlenW
lstrcpyW
lstrcpynW
GlobalFree
lstrcmpiW
EnterCriticalSection
GlobalAlloc
LeaveCriticalSection

user32

UnregisterClassW
CallWindowProcW
LoadImageW
DestroyWindow
BeginPaint
IsWindow
SendMessageW
DefWindowProcW
RedrawWindow
ShowWindow
LoadCursorW
RegisterClassW
CreateWindowExW
SetWindowLongW
GetSystemMetrics
SetWindowPos
DrawTextW
EndPaint
FillRect

gdi32

GetObjectW
DeleteDC
DeleteObject
CreateSolidBrush
CreateCompatibleDC
SelectObject
SetMapMode
GetMapMode
CreateCompatibleBitmap
CreateBitmap
SetBkMode
BitBlt
DPtoLP
SetBkColor
SetTextColor

winmm

PlaySoundW

Exports

Exports

AddImage
AddText
Clear
Destroy
Redraw
SetBg
SetReturn
Sound

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 630B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-unicode/Dialer.dll
.dll windows:4 windows x86 arch:x86

77d42551d0d092e7c42961ca47bb7a69

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GetSystemDirectoryW
GetProcAddress
lstrcpynW
LoadLibraryW

user32

wsprintfW

Exports

Exports

AttemptConnect
AutodialHangup
AutodialOnline
AutodialUnattended
GetConnectedState

Sections

.text
Size: 1024B - Virtual size: 628B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 439B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 204B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 210B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-unicode/InstallOptions.dll
.dll windows:4 windows x86 arch:x86

4b45b7e00344a87332fbd12653854d1a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetCurrentDirectoryW
GlobalUnlock
GlobalLock
GetModuleHandleW
CloseHandle
SetEndOfFile
SetCurrentDirectoryW
GetPrivateProfileStringW
GetPrivateProfileIntW
MultiByteToWideChar
ReadFile
GetFileSize
CreateFileW
lstrcmpiW
lstrcatW
lstrcpynW
WritePrivateProfileStringW
lstrlenW
lstrcpyW
GlobalFree
GlobalAlloc
WriteFile
SetFilePointer

user32

LoadCursorW
SetWindowRgn
GetDlgCtrlID
CloseClipboard
DrawFocusRect
OpenClipboard
DrawTextW
SetCursor
LoadIconW
LoadImageW
SetWindowLongW
CreateWindowExW
MapDialogRect
SetWindowPos
GetWindowRect
CreateDialogParamW
GetClientRect
ShowWindow
GetSystemMenu
EnableWindow
GetDlgItem
DestroyIcon
DestroyWindow
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
CallWindowProcW
PostMessageW
MessageBoxW
GetSysColor
CharNextW
wsprintfW
GetWindowTextW
SetWindowTextW
SendMessageW
GetWindowLongW
EnableMenuItem
PtInRect
MapWindowPoints
GetClipboardData

gdi32

SetTextColor
DeleteObject
CombineRgn
CreateRectRgn
GetDIBits
SelectObject
CreateCompatibleDC
GetObjectW

shell32

SHGetDesktopFolder
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW

comdlg32

GetOpenFileNameW
GetSaveFileNameW
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

dialog
initDialog
make_unicode
show

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-unicode/LangDLL.dll
.dll windows:4 windows x86 arch:x86

3e8d18bb71c7ebbda2ddc2a4bb03547b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenW
GlobalFree
lstrcpynW
lstrcmpW
GlobalAlloc
MulDiv
GetModuleHandleW
lstrcpyW

user32

DialogBoxParamW
SetDlgItemTextW
SendDlgItemMessageW
EndDialog
SetWindowTextW
LoadIconW
ShowWindow
SendMessageW
GetDC

gdi32

GetDeviceCaps
CreateFontIndirectW
DeleteObject

Exports

Exports

LangDialog

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 681B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-unicode/Math.dll
.dll windows:4 windows x86 arch:x86

82274a6f12e4098899c6a675f5ce59d0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapFree
lstrcmpW
lstrlenW
GlobalFree
lstrcatW
GlobalAlloc
lstrcpynW
WideCharToMultiByte
MultiByteToWideChar
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetCommandLineA
GetVersion
RaiseException
GetProcAddress
GetModuleHandleA
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
lstrcpyW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetCPInfo
GetACP
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
GetLastError
SetFilePointer
HeapAlloc
VirtualAlloc
HeapReAlloc
LCMapStringA
GetStringTypeW
GetOEMCP
LoadLibraryA
GetStringTypeA
FlushFileBuffers
CloseHandle
LCMapStringW
SetStdHandle
RtlUnwind

Exports

Exports

Script

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-unicode/StartMenu.dll
.dll windows:4 windows x86 arch:x86

80469f6834e579db68a646d49780b9d5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcatW
FindClose
FindNextFileW
lstrcmpW
GetModuleHandleW
lstrcmpiW
MulDiv
lstrcpynW
GlobalAlloc
lstrcpyW
FindFirstFileW
GlobalFree

user32

GetMessageW
TranslateMessage
PostMessageW
DispatchMessageW
GetDlgItem
GetWindowLongW
CheckDlgButton
ShowWindow
LoadIconW
GetClientRect
MoveWindow
DestroyWindow
GetWindowRect
ReleaseDC
GetDC
EnableWindow
SetWindowTextW
SendMessageW
IsDlgButtonChecked
GetWindowTextW
CreateDialogParamW
SetWindowLongW
wsprintfW
ScreenToClient
IsDialogMessageW
CallWindowProcW

gdi32

GetTextMetricsW
SelectObject

shell32

SHGetSpecialFolderLocation
SHGetPathFromIDListW

ole32

CoTaskMemFree

Exports

Exports

Init
Select
Show

Sections

.text
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 296B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 578B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-unicode/System.dll
.dll windows:4 windows x86 arch:x86

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfW

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 662B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-unicode/TypeLib.dll
.dll windows:4 windows x86 arch:x86

a0d597336f873f6e7c5eef75af720ebf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyW
lstrcpynW
GlobalAlloc
GlobalFree

user32

wsprintfW

oleaut32

LoadTypeLibEx
RegisterTypeLi
LoadTypeLi
UnRegisterTypeLi

Exports

Exports

GetLibVersion
Register
UnRegister

Sections

.text
Size: 1024B - Virtual size: 582B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 404B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 174B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-unicode/UserInfo.dll
.dll windows:4 windows x86 arch:x86

5e62e8e248e7364886b604bd1fcf4c13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
GetUserNameW

kernel32

GlobalFree
GetVersion
GlobalAlloc
CloseHandle
GetModuleHandleA
GetLastError
GetCurrentProcess
GetCurrentThread
GetProcAddress
lstrcpynW

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 714B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 705B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-unicode/VPatch.dll
.dll windows:4 windows x86 arch:x86

c7ddcff85ef460f0cd774cc11ec1968d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalFree
WriteFile
GetSystemTimeAsFileTime
ReadFile
SetFilePointer
DeleteFileW
CloseHandle
CreateFileW
SetFileTime
lstrcpyW
lstrcpynW
GlobalAlloc
MultiByteToWideChar

Exports

Exports

GetFileCRC32
GetFileMD5
vpatchfile

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 564B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 366B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-unicode/advsplash.dll
.dll windows:4 windows x86 arch:x86

4d85954a016da6eba41af38db29369a8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpynW
LoadLibraryA
lstrcpyW
lstrcatW
GetProcAddress
GlobalAlloc
GlobalFree

user32

EnumDisplaySettingsW
LoadImageW
BeginPaint
SetWindowLongW
SystemParametersInfoW
EndPaint
GetClientRect
CreateWindowExW
DefWindowProcW
DestroyWindow
IsWindow
GetMessageW
DispatchMessageW
UnregisterClassW
wsprintfW
PostMessageW
SetWindowRgn
RegisterClassW
LoadCursorW
SetWindowPos

gdi32

BitBlt
DeleteDC
DeleteObject
CombineRgn
GetObjectW
GetDIBits
SelectObject
CreateCompatibleDC
CreateRectRgn

winmm

timeSetEvent
PlaySoundW
timeKillEvent

Exports

Exports

show

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 220B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-unicode/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

6b5c4f7d679059f68f1269aad3a5cecd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesW
lstrcpyW
MulDiv
lstrlenW
HeapFree
GetCurrentDirectoryW
lstrcmpiW
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
SetCurrentDirectoryW
HeapAlloc

user32

DestroyWindow
CallWindowProcW
SetCursor
LoadCursorW
GetPropW
CharPrevW
DrawFocusRect
GetWindowLongW
DrawTextW
GetClientRect
SetWindowLongW
GetDlgItem
GetSysColor
SetWindowPos
CreateDialogParamW
MapDialogRect
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
CharNextW
SendMessageW
MapWindowPoints
RemovePropW
GetWindowTextW

gdi32

SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW

comdlg32

GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 638B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-unicode/nsExec.dll
.dll windows:4 windows x86 arch:x86

c1c7505e1e6e929ebb6b9100e55b050a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

SetSecurityDescriptorDacl
InitializeSecurityDescriptor
IsTextUnicode

user32

wsprintfW
CharNextExA
SendMessageW
FindWindowExW
CharNextW
CharPrevW

kernel32

CreatePipe
DeleteFileW
lstrcmpiW
GetCommandLineW
ExitProcess
Sleep
TerminateProcess
GlobalReAlloc
MultiByteToWideChar
IsDBCSLeadByteEx
ReadFile
PeekNamedPipe
GetExitCodeProcess
WaitForSingleObject
GetTickCount
lstrcpyW
CreateProcessW
GetStartupInfoW
CreateFileMappingW
GetVersion
GetCurrentProcess
lstrcpynW
lstrlenW
lstrcatW
CloseHandle
UnmapViewOfFile
MapViewOfFile
GlobalFree
CreateFileW
CopyFileW
GetTempFileNameW
GlobalAlloc
GetModuleFileNameW
GetProcAddress
GetModuleHandleA

Exports

Exports

Exec
ExecToLog
ExecToStack

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 420B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-unicode/nsisdl.dll
.dll windows:4 windows x86 arch:x86

ed06d61f6957c32cd324837726a5a070

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

RegQueryValueExA
RegOpenKeyExA
RegCloseKey

wsock32

__WSAFDIsSet
WSAStartup
WSACleanup
send
WSAGetLastError
recv
select
connect
shutdown
closesocket
socket
htons
inet_ntoa
ioctlsocket
gethostbyname

user32

SetWindowLongW
CharPrevA
SetDlgItemTextA
RegisterWindowMessageW
DestroyWindow
EnableWindow
wsprintfA
CallWindowProcW
CreateWindowExW
GetClientRect
ShowWindow
IsWindowVisible
GetFocus
GetDlgItem
FindWindowExW
SetWindowTextA
GetWindowRect
SendMessageW
GetWindowLongW

kernel32

MultiByteToWideChar
WideCharToMultiByte
lstrcpynW
lstrcpyW
CreateFileW
WriteFile
Sleep
DeleteFileW
GetTickCount
MulDiv
GlobalFree
GlobalAlloc
lstrcatA
lstrlenA
lstrcpynA
WaitForSingleObject
CloseHandle
lstrcmpiA
CreateThread
lstrcpyA

Exports

Exports

download
download_quiet

Sections

.text
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 882B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Plugins/x86-unicode/splash.dll
.dll windows:4 windows x86 arch:x86

b2f74f0e1fc649806cefa8459b832b47

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalFree
lstrcpynW
lstrcpyW
lstrcatW

user32

RegisterClassW
LoadImageW
CreateWindowExW
SetTimer
EndPaint
GetClientRect
BeginPaint
IsWindow
ShowWindow
SetWindowPos
SetWindowLongW
SystemParametersInfoW
GetMessageW
DispatchMessageW
UnregisterClassW
wsprintfW
LoadCursorW
DefWindowProcW
DestroyWindow

gdi32

GetObjectW
CreateCompatibleDC
DeleteDC
BitBlt
SelectObject
DeleteObject

winmm

PlaySoundW

Exports

Exports

show

Sections

.text
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 962B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 108B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 290B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nsis/Stubs/bzip2-x86-ansi
.exe windows:4 windows x86 arch:x86

5f0c714c36e6cc016b3a1f4bc86559e4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegOpenKeyExA
RegEnumValueA

shell32

SHGetFileInfoA
SHFileOperationA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA

ole32

IIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

SetClipboardData
CharPrevA
CallWindowProcA
PeekMessageA
DispatchMessageA
MessageBoxIndirectA
GetDlgItemTextA
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
TrackPopupMenu
FillRect
EmptyClipboard
LoadCursorA
GetMessagePos
CheckDlgButton
SetWindowPos
SetCursor
GetSysColor
SetClassLongA
GetWindowLongA
IsWindowEnabled
GetWindowRect
GetSystemMenu
EnableMenuItem
RegisterClassA
ScreenToClient
EndDialog
GetClassInfoA
SystemParametersInfoA
CreateWindowExA
ExitWindowsEx
DialogBoxParamA
CharNextA
SetTimer
DestroyWindow
CreateDialogParamA
SetForegroundWindow
SetWindowTextA
PostQuitMessage
SendMessageTimeoutA
ShowWindow
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
GetDC
SetWindowLongA
LoadImageA
InvalidateRect
ReleaseDC
EnableWindow
BeginPaint
SendMessageA
DefWindowProcA
DrawTextA
GetClientRect
EndPaint
IsWindowVisible
CloseClipboard
OpenClipboard

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetProcAddress
GetSystemDirectoryA
WideCharToMultiByte
MoveFileExA
ReadFile
GetTempFileNameA
WriteFile
RemoveDirectoryA
CreateProcessA
CreateFileA
GetLastError
CreateThread
CreateDirectoryA
GlobalUnlock
GetDiskFreeSpaceA
GlobalLock
SetErrorMode
GetVersionExA
lstrcpynA
GetCommandLineA
GetTempPathA
lstrlenA
SetEnvironmentVariableA
ExitProcess
GetWindowsDirectoryA
GetCurrentProcess
GetModuleFileNameA
CopyFileA
GetTickCount
Sleep
GetFileSize
GetFileAttributesA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetShortPathNameA
MoveFileA
CompareFileTime
SetFileTime
SearchPathA
lstrcmpiA
lstrcmpA
CloseHandle
GlobalFree
GlobalAlloc
ExpandEnvironmentStringsA
LoadLibraryExA
FreeLibrary
lstrcpyA
lstrcatA
FindClose
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
GetModuleHandleA
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1024B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
plugins/nsis/Stubs/bzip2-x86-unicode
.exe windows:4 windows x86 arch:x86

56a78d55f3f7af51443e58e0ce2fb5f6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
plugins/nsis/Stubs/bzip2_solid-x86-ansi
.exe windows:4 windows x86 arch:x86

f10e4da994053bf80c20cee985b32e29

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegOpenKeyExA
RegEnumValueA

shell32

SHGetFileInfoA
SHFileOperationA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA

ole32

IIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

SetClipboardData
CharPrevA
CallWindowProcA
PeekMessageA
DispatchMessageA
MessageBoxIndirectA
GetDlgItemTextA
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
TrackPopupMenu
FillRect
EmptyClipboard
LoadCursorA
GetMessagePos
CheckDlgButton
SetWindowPos
SetCursor
GetSysColor
SetClassLongA
GetWindowLongA
IsWindowEnabled
GetWindowRect
GetSystemMenu
EnableMenuItem
RegisterClassA
ScreenToClient
EndDialog
GetClassInfoA
SystemParametersInfoA
CreateWindowExA
ExitWindowsEx
DialogBoxParamA
CharNextA
SetTimer
DestroyWindow
CreateDialogParamA
SetForegroundWindow
SetWindowTextA
PostQuitMessage
SendMessageTimeoutA
ShowWindow
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
GetDC
SetWindowLongA
LoadImageA
InvalidateRect
ReleaseDC
EnableWindow
BeginPaint
SendMessageA
DefWindowProcA
DrawTextA
GetClientRect
EndPaint
IsWindowVisible
CloseClipboard
OpenClipboard

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetProcAddress
GetSystemDirectoryA
WideCharToMultiByte
MoveFileExA
GetTempFileNameA
RemoveDirectoryA
WriteFile
CreateDirectoryA
GetLastError
CreateProcessA
GlobalLock
GlobalUnlock
CreateThread
lstrcpynA
SetErrorMode
GetDiskFreeSpaceA
lstrlenA
GetCommandLineA
GetVersionExA
GetWindowsDirectoryA
SetEnvironmentVariableA
GetTempPathA
CopyFileA
GetCurrentProcess
ExitProcess
GetModuleFileNameA
GetFileSize
ReadFile
GetTickCount
Sleep
CreateFileA
GetFileAttributesA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetShortPathNameA
MoveFileA
CompareFileTime
SetFileTime
SearchPathA
lstrcmpiA
lstrcmpA
CloseHandle
GlobalFree
GlobalAlloc
ExpandEnvironmentStringsA
LoadLibraryExA
FreeLibrary
lstrcpyA
lstrcatA
FindClose
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
GetModuleHandleA
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1024B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
plugins/nsis/Stubs/bzip2_solid-x86-unicode
.exe windows:4 windows x86 arch:x86

61259b55b8912888e90f516ca08dc514

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
plugins/nsis/Stubs/lzma-x86-ansi
.exe windows:4 windows x86 arch:x86

5f0c714c36e6cc016b3a1f4bc86559e4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegOpenKeyExA
RegEnumValueA

shell32

SHGetFileInfoA
SHFileOperationA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA

ole32

IIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

SetClipboardData
CharPrevA
CallWindowProcA
PeekMessageA
DispatchMessageA
MessageBoxIndirectA
GetDlgItemTextA
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
TrackPopupMenu
FillRect
EmptyClipboard
LoadCursorA
GetMessagePos
CheckDlgButton
SetWindowPos
SetCursor
GetSysColor
SetClassLongA
GetWindowLongA
IsWindowEnabled
GetWindowRect
GetSystemMenu
EnableMenuItem
RegisterClassA
ScreenToClient
EndDialog
GetClassInfoA
SystemParametersInfoA
CreateWindowExA
ExitWindowsEx
DialogBoxParamA
CharNextA
SetTimer
DestroyWindow
CreateDialogParamA
SetForegroundWindow
SetWindowTextA
PostQuitMessage
SendMessageTimeoutA
ShowWindow
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
GetDC
SetWindowLongA
LoadImageA
InvalidateRect
ReleaseDC
EnableWindow
BeginPaint
SendMessageA
DefWindowProcA
DrawTextA
GetClientRect
EndPaint
IsWindowVisible
CloseClipboard
OpenClipboard

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetProcAddress
GetSystemDirectoryA
WideCharToMultiByte
MoveFileExA
ReadFile
GetTempFileNameA
WriteFile
RemoveDirectoryA
CreateProcessA
CreateFileA
GetLastError
CreateThread
CreateDirectoryA
GlobalUnlock
GetDiskFreeSpaceA
GlobalLock
SetErrorMode
GetVersionExA
lstrcpynA
GetCommandLineA
GetTempPathA
lstrlenA
SetEnvironmentVariableA
ExitProcess
GetWindowsDirectoryA
GetCurrentProcess
GetModuleFileNameA
CopyFileA
GetTickCount
Sleep
GetFileSize
GetFileAttributesA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetShortPathNameA
MoveFileA
CompareFileTime
SetFileTime
SearchPathA
lstrcmpiA
lstrcmpA
CloseHandle
GlobalFree
GlobalAlloc
ExpandEnvironmentStringsA
LoadLibraryExA
FreeLibrary
lstrcpyA
lstrcatA
FindClose
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
GetModuleHandleA
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1024B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
plugins/nsis/Stubs/lzma-x86-unicode
.exe windows:4 windows x86 arch:x86

56a78d55f3f7af51443e58e0ce2fb5f6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
plugins/nsis/Stubs/lzma_solid-x86-ansi
.exe windows:4 windows x86 arch:x86

f10e4da994053bf80c20cee985b32e29

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegOpenKeyExA
RegEnumValueA

shell32

SHGetFileInfoA
SHFileOperationA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA

ole32

IIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

SetClipboardData
CharPrevA
CallWindowProcA
PeekMessageA
DispatchMessageA
MessageBoxIndirectA
GetDlgItemTextA
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
TrackPopupMenu
FillRect
EmptyClipboard
LoadCursorA
GetMessagePos
CheckDlgButton
SetWindowPos
SetCursor
GetSysColor
SetClassLongA
GetWindowLongA
IsWindowEnabled
GetWindowRect
GetSystemMenu
EnableMenuItem
RegisterClassA
ScreenToClient
EndDialog
GetClassInfoA
SystemParametersInfoA
CreateWindowExA
ExitWindowsEx
DialogBoxParamA
CharNextA
SetTimer
DestroyWindow
CreateDialogParamA
SetForegroundWindow
SetWindowTextA
PostQuitMessage
SendMessageTimeoutA
ShowWindow
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
GetDC
SetWindowLongA
LoadImageA
InvalidateRect
ReleaseDC
EnableWindow
BeginPaint
SendMessageA
DefWindowProcA
DrawTextA
GetClientRect
EndPaint
IsWindowVisible
CloseClipboard
OpenClipboard

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetProcAddress
GetSystemDirectoryA
WideCharToMultiByte
MoveFileExA
GetTempFileNameA
RemoveDirectoryA
WriteFile
CreateDirectoryA
GetLastError
CreateProcessA
GlobalLock
GlobalUnlock
CreateThread
lstrcpynA
SetErrorMode
GetDiskFreeSpaceA
lstrlenA
GetCommandLineA
GetVersionExA
GetWindowsDirectoryA
SetEnvironmentVariableA
GetTempPathA
CopyFileA
GetCurrentProcess
ExitProcess
GetModuleFileNameA
GetFileSize
ReadFile
GetTickCount
Sleep
CreateFileA
GetFileAttributesA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetShortPathNameA
MoveFileA
CompareFileTime
SetFileTime
SearchPathA
lstrcmpiA
lstrcmpA
CloseHandle
GlobalFree
GlobalAlloc
ExpandEnvironmentStringsA
LoadLibraryExA
FreeLibrary
lstrcpyA
lstrcatA
FindClose
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
GetModuleHandleA
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv

Sections

.text
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1024B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
plugins/nsis/Stubs/lzma_solid-x86-unicode
.exe windows:4 windows x86 arch:x86

61259b55b8912888e90f516ca08dc514

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
plugins/nsis/Stubs/uninst
plugins/nsis/Stubs/zlib-x86-ansi
.exe windows:4 windows x86 arch:x86

5f0c714c36e6cc016b3a1f4bc86559e4

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegOpenKeyExA
RegEnumValueA

shell32

SHGetFileInfoA
SHFileOperationA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA

ole32

IIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

SetClipboardData
CharPrevA
CallWindowProcA
PeekMessageA
DispatchMessageA
MessageBoxIndirectA
GetDlgItemTextA
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
TrackPopupMenu
FillRect
EmptyClipboard
LoadCursorA
GetMessagePos
CheckDlgButton
SetWindowPos
SetCursor
GetSysColor
SetClassLongA
GetWindowLongA
IsWindowEnabled
GetWindowRect
GetSystemMenu
EnableMenuItem
RegisterClassA
ScreenToClient
EndDialog
GetClassInfoA
SystemParametersInfoA
CreateWindowExA
ExitWindowsEx
DialogBoxParamA
CharNextA
SetTimer
DestroyWindow
CreateDialogParamA
SetForegroundWindow
SetWindowTextA
PostQuitMessage
SendMessageTimeoutA
ShowWindow
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
GetDC
SetWindowLongA
LoadImageA
InvalidateRect
ReleaseDC
EnableWindow
BeginPaint
SendMessageA
DefWindowProcA
DrawTextA
GetClientRect
EndPaint
IsWindowVisible
CloseClipboard
OpenClipboard

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetProcAddress
GetSystemDirectoryA
WideCharToMultiByte
MoveFileExA
ReadFile
GetTempFileNameA
WriteFile
RemoveDirectoryA
CreateProcessA
CreateFileA
GetLastError
CreateThread
CreateDirectoryA
GlobalUnlock
GetDiskFreeSpaceA
GlobalLock
SetErrorMode
GetVersionExA
lstrcpynA
GetCommandLineA
GetTempPathA
lstrlenA
SetEnvironmentVariableA
ExitProcess
GetWindowsDirectoryA
GetCurrentProcess
GetModuleFileNameA
CopyFileA
GetTickCount
Sleep
GetFileSize
GetFileAttributesA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetShortPathNameA
MoveFileA
CompareFileTime
SetFileTime
SearchPathA
lstrcmpiA
lstrcmpA
CloseHandle
GlobalFree
GlobalAlloc
ExpandEnvironmentStringsA
LoadLibraryExA
FreeLibrary
lstrcpyA
lstrcatA
FindClose
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
GetModuleHandleA
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1024B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
plugins/nsis/Stubs/zlib-x86-unicode
.exe windows:4 windows x86 arch:x86

56a78d55f3f7af51443e58e0ce2fb5f6

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
CreateFileW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
plugins/nsis/Stubs/zlib_solid-x86-ansi
.exe windows:4 windows x86 arch:x86

f10e4da994053bf80c20cee985b32e29

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExA
RegEnumKeyA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
SetFileSecurityA
RegOpenKeyExA
RegEnumValueA

shell32

SHGetFileInfoA
SHFileOperationA
SHGetPathFromIDListA
ShellExecuteExA
SHGetSpecialFolderLocation
SHBrowseForFolderA

ole32

IIDFromString
OleInitialize
OleUninitialize
CoCreateInstance
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

SetClipboardData
CharPrevA
CallWindowProcA
PeekMessageA
DispatchMessageA
MessageBoxIndirectA
GetDlgItemTextA
SetDlgItemTextA
GetSystemMetrics
CreatePopupMenu
AppendMenuA
TrackPopupMenu
FillRect
EmptyClipboard
LoadCursorA
GetMessagePos
CheckDlgButton
SetWindowPos
SetCursor
GetSysColor
SetClassLongA
GetWindowLongA
IsWindowEnabled
GetWindowRect
GetSystemMenu
EnableMenuItem
RegisterClassA
ScreenToClient
EndDialog
GetClassInfoA
SystemParametersInfoA
CreateWindowExA
ExitWindowsEx
DialogBoxParamA
CharNextA
SetTimer
DestroyWindow
CreateDialogParamA
SetForegroundWindow
SetWindowTextA
PostQuitMessage
SendMessageTimeoutA
ShowWindow
wsprintfA
GetDlgItem
FindWindowExA
IsWindow
GetDC
SetWindowLongA
LoadImageA
InvalidateRect
ReleaseDC
EnableWindow
BeginPaint
SendMessageA
DefWindowProcA
DrawTextA
GetClientRect
EndPaint
IsWindowVisible
CloseClipboard
OpenClipboard

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectA
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetProcAddress
GetSystemDirectoryA
WideCharToMultiByte
MoveFileExA
GetTempFileNameA
RemoveDirectoryA
WriteFile
CreateDirectoryA
GetLastError
CreateProcessA
GlobalLock
GlobalUnlock
CreateThread
lstrcpynA
SetErrorMode
GetDiskFreeSpaceA
lstrlenA
GetCommandLineA
GetVersionExA
GetWindowsDirectoryA
SetEnvironmentVariableA
GetTempPathA
CopyFileA
GetCurrentProcess
ExitProcess
GetModuleFileNameA
GetFileSize
ReadFile
GetTickCount
Sleep
CreateFileA
GetFileAttributesA
SetCurrentDirectoryA
SetFileAttributesA
GetFullPathNameA
GetShortPathNameA
MoveFileA
CompareFileTime
SetFileTime
SearchPathA
lstrcmpiA
lstrcmpA
CloseHandle
GlobalFree
GlobalAlloc
ExpandEnvironmentStringsA
LoadLibraryExA
FreeLibrary
lstrcpyA
lstrcatA
FindClose
MultiByteToWideChar
WritePrivateProfileStringA
GetPrivateProfileStringA
SetFilePointer
GetModuleHandleA
FindNextFileA
FindFirstFileA
DeleteFileA
MulDiv

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 1024B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
plugins/nsis/Stubs/zlib_solid-x86-unicode
.exe windows:4 windows x86 arch:x86

61259b55b8912888e90f516ca08dc514

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
plugins/nsis/makensis.exe
.exe windows:4 windows x86 arch:x86

d1a6d7f422685c92336387a87c71e968

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetCommandLineW
GetLastError
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
lstrcatW
GetModuleFileNameW
lstrlenW
ExitProcess
LocalReAlloc
LocalAlloc
WriteFile
GetStdHandle

user32

wvsprintfA

Sections

.text
Size: 512B - Virtual size: 511B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 442B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 60B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
plugins/nxd/Desh32.dll
.dll windows:5 windows x86 arch:x86

20f88c7aa7ee0e4ab664dc419efb0ed7

Code Sign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d0:c1:13:3e:c6:9e:f4:7a:50:dd:71:79:f3:e5:a4:f0:24:75:7f:1e:23:3b:33:a2:a4:47:50:1c:37:db:c4:02
Signer

Actual PE Digest

d0:c1:13:3e:c6:9e:f4:7a:50:dd:71:79:f3:e5:a4:f0:24:75:7f:1e:23:3b:33:a2:a4:47:50:1c:37:db:c4:02

Digest Algorithm

sha256

PE Digest Matches

true

d0:c1:13:3e:c6:9e:f4:7a:50:dd:71:79:f3:e5:a4:f0:24:75:7f:1e:23:3b:33:a2:a4:47:50:1c:37:db:c4:02
Signer

Actual PE Digest

d0:c1:13:3e:c6:9e:f4:7a:50:dd:71:79:f3:e5:a4:f0:24:75:7f:1e:23:3b:33:a2:a4:47:50:1c:37:db:c4:02

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\des\Desh32.pdb

Imports

kernel32

ReadFile
CreateFileW
GetCurrentProcessId
CloseHandle
GetFileSizeEx
Sleep
WriteFile
GetTickCount
WriteConsoleW
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
HeapReAlloc
GetStringTypeW
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
RtlUnwind
DeleteCriticalSection
GetFileType
InitializeCriticalSectionAndSpinCount
GetStdHandle
SetHandleCount
ExitProcess
HeapSize
IsProcessorFeaturePresent
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
CreateFileA
GetCurrentProcess
GetStartupInfoW
GetLastError
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
SetFileAttributesW
HeapAlloc
HeapFree
GetProcessHeap
SetLastError
GetModuleFileNameW
SetFilePointer
SetEndOfFile
GetModuleHandleW
LoadLibraryW
GetVersionExW
TerminateProcess
GetProcAddress
GetModuleHandleA
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
GetCommandLineA
RaiseException
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW

shlwapi

PathAppendW
PathFileExistsW
wnsprintfA
PathIsDirectoryW
PathFindExtensionW
PathGetDriveNumberW
PathIsRootW

sfc

SfcIsFileProtected

nefs32

UD_EncryptFile
SefsSecuProcListCheckEx
SefsOpenModule
UD_DecryptFile
UD_Initialize
UD_IsTestFileKey

Exports

Exports

DES_DecryptFile
DES_EncryptFile
DES_Init
DES_IsAuthProc
DES_IsEncryptedFile
DES_IsKeyMached
DES_IsLocalDecryptEnable

Sections

.text
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/Desh64.dll
.dll windows:5 windows x64 arch:x64

4958fff9d74c86cff95a17280e8d015c

Code Sign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f1:40:17:04:bf:48:aa:93:d2:31:d4:0b:d8:89:05:46:5e:37:0b:bd:cc:b1:e2:ac:e3:a4:70:21:23:b1:21:f0
Signer

Actual PE Digest

f1:40:17:04:bf:48:aa:93:d2:31:d4:0b:d8:89:05:46:5e:37:0b:bd:cc:b1:e2:ac:e3:a4:70:21:23:b1:21:f0

Digest Algorithm

sha256

PE Digest Matches

true

f1:40:17:04:bf:48:aa:93:d2:31:d4:0b:d8:89:05:46:5e:37:0b:bd:cc:b1:e2:ac:e3:a4:70:21:23:b1:21:f0
Signer

Actual PE Digest

f1:40:17:04:bf:48:aa:93:d2:31:d4:0b:d8:89:05:46:5e:37:0b:bd:cc:b1:e2:ac:e3:a4:70:21:23:b1:21:f0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\des\Desh64.pdb

Imports

kernel32

ReadFile
CreateFileW
GetCurrentProcessId
CloseHandle
GetFileSizeEx
Sleep
WriteFile
GetTickCount
WriteConsoleW
FlushFileBuffers
SetStdHandle
GetConsoleMode
GetConsoleCP
HeapReAlloc
GetStringTypeW
QueryPerformanceCounter
HeapDestroy
HeapCreate
GetVersion
HeapSetInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
DeleteCriticalSection
GetFileType
InitializeCriticalSectionAndSpinCount
GetStdHandle
SetHandleCount
ExitProcess
HeapSize
RtlUnwindEx
FlsAlloc
FlsFree
FlsGetValue
IsValidCodePage
GetOEMCP
CreateFileA
GetCurrentProcess
GetStartupInfoW
GetLastError
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetModuleFileNameA
SetFileAttributesW
HeapAlloc
HeapFree
GetProcessHeap
SetLastError
GetModuleFileNameW
SetFilePointer
SetEndOfFile
GetModuleHandleW
LoadLibraryW
GetVersionExW
TerminateProcess
GetProcAddress
GetCurrentThreadId
WideCharToMultiByte
MultiByteToWideChar
EncodePointer
DecodePointer
GetSystemTimeAsFileTime
FlsSetValue
GetCommandLineA
RaiseException
RtlPcToFileHeader
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetACP

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW

shlwapi

PathAppendW
PathFileExistsW
wnsprintfA
PathIsDirectoryW
PathFindExtensionW
PathGetDriveNumberW
PathIsRootW

sfc

SfcIsFileProtected

nefs64

UD_EncryptFile
SefsSecuProcListCheckEx
SefsOpenModule
UD_DecryptFile
UD_Initialize
UD_IsTestFileKey

Exports

Exports

DES_DecryptFile
DES_EncryptFile
DES_Init
DES_IsAuthProc
DES_IsEncryptedFile
DES_IsKeyMached
DES_IsLocalDecryptEnable

Sections

.text
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/NeFs32.dll
.dll windows:5 windows x86 arch:x86

e885caab5058648ad4fc2eaf9ed0e4a9

Code Sign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f5:86:59:39:a8:66:02:1d:2d:79:aa:8e:09:6d:fc:1f:ab:0e:a4:c8:be:10:3d:61:08:4e:12:03:92:52:0a:79
Signer

Actual PE Digest

f5:86:59:39:a8:66:02:1d:2d:79:aa:8e:09:6d:fc:1f:ab:0e:a4:c8:be:10:3d:61:08:4e:12:03:92:52:0a:79

Digest Algorithm

sha256

PE Digest Matches

true

f5:86:59:39:a8:66:02:1d:2d:79:aa:8e:09:6d:fc:1f:ab:0e:a4:c8:be:10:3d:61:08:4e:12:03:92:52:0a:79
Signer

Actual PE Digest

f5:86:59:39:a8:66:02:1d:2d:79:aa:8e:09:6d:fc:1f:ab:0e:a4:c8:be:10:3d:61:08:4e:12:03:92:52:0a:79

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

OpenEventW
WriteProcessMemory
OutputDebugStringA
InterlockedIncrement
GetQueuedCompletionStatus
InterlockedDecrement
SetThreadPriority
WaitForMultipleObjects
CreateIoCompletionPort
CancelIo
GetCurrentThreadId
DebugBreak
ResumeThread
FindFirstFileW
SetFilePointer
SetEndOfFile
MoveFileExW
SetFilePointerEx
CreateDirectoryW
UnlockFile
LockFile
SetFileTime
WriteFile
GetVolumePathNameW
ReadFile
FlushFileBuffers
GetFileSizeEx
MoveFileW
GetDiskFreeSpaceW
FindClose
RemoveDirectoryW
FindNextFileW
GetDiskFreeSpaceExW
DeleteFileW
GetFileInformationByHandle
SetFileAttributesW
SetLastError
SetWaitableTimer
CreateWaitableTimerW
RaiseException
GetExitCodeThread
VirtualAllocEx
GetProcAddress
GetExitCodeProcess
GetVersionExW
TerminateThread
VirtualFreeEx
CreateRemoteThread
GetModuleHandleW
CreateProcessW
CreateEventW
CreateFileMappingW
GetCurrentProcessId
DuplicateHandle
ResetEvent
lstrcpynW
SetEvent
WaitForSingleObject
GetCurrentProcess
SystemTimeToFileTime
LocalFree
UnmapViewOfFile
MapViewOfFile
GetSystemInfo
SetNamedPipeHandleState
DeviceIoControl
DefineDosDeviceW
CreateFileW
GetModuleFileNameW
TransactNamedPipe
WaitNamedPipeW
GetSystemTime
GetFileAttributesW
SystemTimeToTzSpecificLocalTime
Sleep
CloseHandle
OpenProcess
CreateThread
DeleteCriticalSection
QueryDosDeviceW
EnterCriticalSection
GetLocalTime
SetFileAttributesA
OpenMutexW
GetSystemDirectoryA
CreateFileA
HeapSize
GetProcessHeap
IsProcessorFeaturePresent
WriteConsoleW
HeapReAlloc
LoadLibraryW
SetStdHandle
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
MultiByteToWideChar
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
GetStartupInfoW
GetFileType
GetLongPathNameW
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
GetLogicalDriveStringsW
SetHandleCount
GetStdHandle
ExitProcess
HeapDestroy
HeapCreate
RtlUnwind
GetStringTypeW
LCMapStringW
HeapFree
HeapAlloc
DecodePointer
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree

user32

CreateWindowExW
GetWindowLongW
EmptyClipboard
OpenClipboard
TranslateMessage
PostQuitMessage
GetMessageW
CloseClipboard
PostMessageW
DispatchMessageW
DefWindowProcW
RegisterClassW
PostThreadMessageW
GetForegroundWindow
RegisterWindowMessageW
BroadcastSystemMessageW
GetWindowThreadProcessId
GetShellWindow
DestroyWindow
GetUserObjectSecurity
SetUserObjectSecurity
MessageBoxW
wsprintfA

advapi32

RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegCreateKeyW
OpenProcessToken
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
QueryServiceStatus
StartServiceW
CreateServiceW
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
CloseServiceHandle
GetTokenInformation
RegQueryValueExW
ConvertSidToStringSidW

shell32

SHCreateDirectoryExA
SHChangeNotify

ntdll

NtClose
RtlInitUnicodeString
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtQueryInformationProcess

shlwapi

wnsprintfW
wvnsprintfA
PathFindFileNameA
SHSetValueA
PathFileExistsW
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
PathAddBackslashW
wnsprintfA
PathIsNetworkPathW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

sfc

SfcIsFileProtected

psapi

GetModuleBaseNameW
EnumProcesses
GetModuleFileNameExW

Exports

Exports

NeFsConvert2KernelName
NeFsGetDosFilePath
RegisterCloseFileNotify
RegisterCreateFileNotify
SefsAddNewPolicy
SefsCloseModule
SefsDelAllPolicys
SefsDeletePolicy
SefsExportPolicy2File
SefsGetGlobalAccessFlag
SefsGetPolicy
SefsGetPolicyIndexsValue
SefsGetPolicysCount
SefsGlobalNameCleanup
SefsGlobalNameDel
SefsGlobalNameDump
SefsGlobalNameGetAll
SefsGlobalNameSet
SefsImportPolicyFromFile
SefsOpenModule
SefsPolicyAddPathName
SefsPolicyDelAllPathName
SefsPolicyDelPathName
SefsPolicyFileCheckSum
SefsPolicyGetAllPathName
SefsSecuProcGetStatus
SefsSecuProcListAdd
SefsSecuProcListCheck
SefsSecuProcListCheckEx
SefsSecuProcListCleanup
SefsSecuProcListDel
SefsSecuProcListGetCount
SefsSecuProcListGetPids
SefsSecuProcSetStatus
SefsSetGlobalAccessFlag
SefsSetPolciyNotiyCallback
SefsSetPolicy
UD_DecryptFile
UD_Destory
UD_EncryptFile
UD_GetCryptoDesc
UD_GetMountId
UD_GlobalPolicyAdd
UD_GlobalPolicyCleanup
UD_GlobalPolicyDel
UD_Initialize
UD_IsEncryptedFile
UD_IsEncryptedFileEx
UD_IsTestFileKey
UD_IsValidFunChar
UD_IsValidFunCharForKrl
UD_IsValidFunCharForUser
UD_SetProcNotify
UD_UpdateMaxCopyChars
UD_UpdateUserCtrlFlags
_UfsdGetDeviceMountId@8
_UfsdGetDeviceName@12
_UfsdGetFilterStatus@4
_UfsdGetWorkThreadIds@12
_UfsdMount@4
_UfsdRegisterFSD@12
_UfsdResetTimeout@8
_UfsdSetAliveTimeout@8
_UfsdStartFilter@4
_UfsdStopFilter@4
_UfsdUnRegisterFSD@4
_UfsdUnRegisterFSDForName@4
_UfsdUnmount@4
_UfsdUpdateMirrorPath@8

Sections

.text
Size: 159KB - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/NeFs64.dll
.dll windows:5 windows x64 arch:x64

a828f1bc8778df70053cdd4575bdef76

Code Sign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

87:d9:7f:7c:2a:41:85:39:4e:a7:45:ca:91:68:fb:9a:89:17:c1:a0:4f:af:2f:9e:9b:42:14:ac:9d:40:39:ed
Signer

Actual PE Digest

87:d9:7f:7c:2a:41:85:39:4e:a7:45:ca:91:68:fb:9a:89:17:c1:a0:4f:af:2f:9e:9b:42:14:ac:9d:40:39:ed

Digest Algorithm

sha256

PE Digest Matches

true

87:d9:7f:7c:2a:41:85:39:4e:a7:45:ca:91:68:fb:9a:89:17:c1:a0:4f:af:2f:9e:9b:42:14:ac:9d:40:39:ed
Signer

Actual PE Digest

87:d9:7f:7c:2a:41:85:39:4e:a7:45:ca:91:68:fb:9a:89:17:c1:a0:4f:af:2f:9e:9b:42:14:ac:9d:40:39:ed

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

OpenEventW
WriteProcessMemory
OutputDebugStringA
GetQueuedCompletionStatus
SetThreadPriority
WaitForMultipleObjects
CreateIoCompletionPort
CancelIo
GetCurrentThreadId
DebugBreak
ResumeThread
FindFirstFileW
SetFilePointer
SetEndOfFile
MoveFileExW
SetFilePointerEx
CreateDirectoryW
UnlockFile
LockFile
SetFileTime
WriteFile
GetVolumePathNameW
ReadFile
FlushFileBuffers
GetFileSizeEx
MoveFileW
GetDiskFreeSpaceW
FindClose
RemoveDirectoryW
FindNextFileW
GetDiskFreeSpaceExW
DeleteFileW
GetFileInformationByHandle
SetFileAttributesW
SetLastError
SetWaitableTimer
CreateWaitableTimerW
RtlPcToFileHeader
RaiseException
GetExitCodeThread
VirtualAllocEx
GetProcAddress
GetExitCodeProcess
GetVersionExW
TerminateThread
VirtualFreeEx
CreateRemoteThread
GetModuleHandleW
CreateProcessW
CreateEventW
CreateFileMappingW
GetCurrentProcessId
DuplicateHandle
ResetEvent
lstrcpynW
SetEvent
WaitForSingleObject
GetCurrentProcess
SystemTimeToFileTime
UnmapViewOfFile
MapViewOfFile
GetSystemInfo
SetNamedPipeHandleState
DeviceIoControl
DefineDosDeviceW
CreateFileW
GetModuleFileNameW
TransactNamedPipe
WaitNamedPipeW
GetSystemTime
GetFileAttributesW
SystemTimeToTzSpecificLocalTime
Sleep
CloseHandle
OpenProcess
CreateThread
DeleteCriticalSection
QueryDosDeviceW
EnterCriticalSection
LocalFree
GetLocalTime
SetFileAttributesA
OpenMutexW
GetSystemDirectoryA
CreateFileA
HeapSize
GetProcessHeap
WriteConsoleW
HeapReAlloc
LoadLibraryW
SetStdHandle
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameA
MultiByteToWideChar
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
GetStartupInfoW
GetFileType
SetHandleCount
GetLongPathNameW
GetLastError
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
OutputDebugStringW
GetLogicalDriveStringsW
GetStdHandle
ExitProcess
HeapDestroy
HeapCreate
GetVersion
HeapSetInformation
RtlUnwindEx
GetStringTypeW
HeapFree
HeapAlloc
FlsSetValue
GetCommandLineA
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
FlsGetValue
FlsFree
FlsAlloc
DecodePointer
LCMapStringW

user32

GetForegroundWindow
EmptyClipboard
OpenClipboard
TranslateMessage
PostQuitMessage
GetMessageW
MessageBoxW
DispatchMessageW
CloseClipboard
PostMessageW
DefWindowProcW
RegisterClassW
PostThreadMessageW
GetWindowLongPtrW
CreateWindowExW
RegisterWindowMessageW
BroadcastSystemMessageW
GetWindowThreadProcessId
GetShellWindow
DestroyWindow
GetUserObjectSecurity
SetUserObjectSecurity
wsprintfA

advapi32

RegOpenKeyExW
RegSetValueExW
RegCloseKey
RegCreateKeyExW
RegCreateKeyW
OpenProcessToken
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
QueryServiceStatus
StartServiceW
CreateServiceW
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
CloseServiceHandle
GetTokenInformation
RegQueryValueExW
ConvertSidToStringSidW

shell32

SHCreateDirectoryExA
SHChangeNotify

ntdll

NtClose
RtlInitUnicodeString
NtOpenSymbolicLinkObject
NtQuerySymbolicLinkObject
NtQueryInformationProcess

shlwapi

PathIsNetworkPathW
wnsprintfW
wvnsprintfA
PathFindFileNameA
SHSetValueA
PathRemoveFileSpecW
PathFindFileNameW
PathIsDirectoryW
PathAddBackslashW
wnsprintfA
PathFileExistsW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

sfc

SfcIsFileProtected

psapi

GetModuleBaseNameW
EnumProcesses
GetModuleFileNameExW

Exports

Exports

NeFsConvert2KernelName
NeFsGetDosFilePath
RegisterCloseFileNotify
RegisterCreateFileNotify
SefsAddNewPolicy
SefsCloseModule
SefsDelAllPolicys
SefsDeletePolicy
SefsExportPolicy2File
SefsGetGlobalAccessFlag
SefsGetPolicy
SefsGetPolicyIndexsValue
SefsGetPolicysCount
SefsGlobalNameCleanup
SefsGlobalNameDel
SefsGlobalNameDump
SefsGlobalNameGetAll
SefsGlobalNameSet
SefsImportPolicyFromFile
SefsOpenModule
SefsPolicyAddPathName
SefsPolicyDelAllPathName
SefsPolicyDelPathName
SefsPolicyFileCheckSum
SefsPolicyGetAllPathName
SefsSecuProcGetStatus
SefsSecuProcListAdd
SefsSecuProcListCheck
SefsSecuProcListCheckEx
SefsSecuProcListCleanup
SefsSecuProcListDel
SefsSecuProcListGetCount
SefsSecuProcListGetPids
SefsSecuProcSetStatus
SefsSetGlobalAccessFlag
SefsSetPolciyNotiyCallback
SefsSetPolicy
UD_DecryptFile
UD_Destory
UD_EncryptFile
UD_GetCryptoDesc
UD_GetMountId
UD_GlobalPolicyAdd
UD_GlobalPolicyCleanup
UD_GlobalPolicyDel
UD_Initialize
UD_IsEncryptedFile
UD_IsEncryptedFileEx
UD_IsTestFileKey
UD_IsValidFunChar
UD_IsValidFunCharForKrl
UD_IsValidFunCharForUser
UD_SetProcNotify
UD_UpdateMaxCopyChars
UD_UpdateUserCtrlFlags

Sections

.text
Size: 172KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/NxDes32.dll
.dll windows:5 windows x86 arch:x86

49430e2ddbe59ae615d07801ce11ce58

Code Sign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f6:f1:f5:21:cf:79:e3:25:ae:6c:13:74:1c:8a:80:7c:51:63:3a:49:65:c2:22:15:28:2e:56:3c:74:02:d3:f6
Signer

Actual PE Digest

f6:f1:f5:21:cf:79:e3:25:ae:6c:13:74:1c:8a:80:7c:51:63:3a:49:65:c2:22:15:28:2e:56:3c:74:02:d3:f6

Digest Algorithm

sha256

PE Digest Matches

true

f6:f1:f5:21:cf:79:e3:25:ae:6c:13:74:1c:8a:80:7c:51:63:3a:49:65:c2:22:15:28:2e:56:3c:74:02:d3:f6
Signer

Actual PE Digest

f6:f1:f5:21:cf:79:e3:25:ae:6c:13:74:1c:8a:80:7c:51:63:3a:49:65:c2:22:15:28:2e:56:3c:74:02:d3:f6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\des\NxDes32.pdb

Imports

kernel32

WideCharToMultiByte
FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
DeleteCriticalSection
GetCurrentThreadId
OutputDebugStringA
GetVersionExA
DeleteFileW
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
CopyFileA
ResetEvent
CreateEventW
ExitProcess
SetErrorMode
GetModuleFileNameW
OpenMutexW
GetSystemDirectoryW
CopyFileW
SleepEx
QueueUserAPC
InitializeCriticalSection
GetTimeZoneInformation
SetStdHandle
RtlUnwind
LCMapStringW
UnlockFileEx
GetConsoleCP
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
FormatMessageA
GetSystemTimeAsFileTime
OutputDebugStringW
WaitForSingleObjectEx
LockFile
FlushViewOfFile
UnlockFile
IsProcessorFeaturePresent
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
IsDebuggerPresent
UnhandledExceptionFilter
RaiseException
GetCommandLineA
CreateThread
ExitThread
InterlockedExchange
DecodePointer
EncodePointer
WriteProcessMemory
VirtualProtect
SetUnhandledExceptionFilter
GetSystemDirectoryA
GetLocalTime
GetProcessHeap
lstrlenW
CancelIo
FreeEnvironmentStringsW
GetModuleHandleA
DeviceIoControl
QueryDosDeviceW
InterlockedCompareExchange
HeapFree
QueryPerformanceCounter
SystemTimeToFileTime
HeapAlloc
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
TryEnterCriticalSection
SetFilePointer
HeapCompact
GetFileSize
HeapReAlloc
GetFullPathNameA
GetFullPathNameW
GetProcAddress
GetStdHandle
LoadLibraryW
GetCurrentProcess
FreeLibrary
GetCurrentProcessId
CloseHandle
GetFileAttributesExW
GetFileSizeEx
Sleep
TerminateThread
WriteFile
GetTickCount
SetEvent
TerminateProcess
WaitForSingleObject
SetFilePointerEx
CreateMutexW
GetConsoleMode
CreateFileA
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
GetStringTypeW
GetEnvironmentStringsW
GetStartupInfoW
GetModuleFileNameA
GetLogicalDrives
SetFileAttributesW
GetDriveTypeA
GetVolumeInformationA
SetFileAttributesA
GetPrivateProfileStringA
SetLastError
GetModuleHandleW
OpenProcess
lstrcpynW

user32

DefWindowProcW
DispatchMessageA
CreateWindowExW
LoadIconW
RegisterClassExW
TranslateMessage
LoadCursorW
RegisterWindowMessageW
wsprintfA
SendMessageTimeoutW
CharUpperW
GetMessageW
PostQuitMessage
DestroyWindow

gdi32

GetStockObject

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegOpenKeyExW
RegOpenKeyExA
OpenProcessToken
GetTokenInformation
RegCreateKeyExW
RegQueryValueExA
RegQueryValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
ConvertSidToStringSidW
RegSetValueExW

shell32

SHCreateDirectoryExW
SHCreateDirectoryExA
SHGetSpecialFolderPathW

shlwapi

SHSetValueW
SHSetValueA
PathFindFileNameW
StrStrIW
SHGetValueW
PathAppendW
PathMatchSpecW
wnsprintfA
PathFileExistsW
PathFileExistsA
wnsprintfW
SHDeleteValueA
wvnsprintfA
PathAppendA
StrToIntExA
PathFindFileNameA

gdiplus

GdiplusStartup

nefs32

RegisterCloseFileNotify
SefsDelAllPolicys
SefsPolicyAddPathName
SefsGlobalNameSet
SefsGlobalNameCleanup
UD_Destory
SefsAddNewPolicy
RegisterCreateFileNotify
UD_Initialize
SefsSetGlobalAccessFlag
SefsCloseModule
SefsOpenModule

iphlpapi

GetAdaptersAddresses

netapi32

Netbios

ws2_32

WSASend
WSAGetOverlappedResult
connect
WSARecv
inet_addr
WSAGetLastError
htons
socket
closesocket
WSAStartup

dbghelp

MiniDumpWriteDump

Exports

Exports

DesMain

Sections

.text
Size: 718KB - Virtual size: 717KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/NxDes64.dll
.dll windows:5 windows x64 arch:x64

bd7486368836c6b319df4fd3ebcb7f83

Code Sign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e9:3e:b5:01:cb:5f:dd:00:3a:1b:d4:80:c5:f8:da:74:4a:d4:89:0c:68:2e:57:74:90:75:01:c4:b2:dc:47:f5
Signer

Actual PE Digest

e9:3e:b5:01:cb:5f:dd:00:3a:1b:d4:80:c5:f8:da:74:4a:d4:89:0c:68:2e:57:74:90:75:01:c4:b2:dc:47:f5

Digest Algorithm

sha256

PE Digest Matches

true

e9:3e:b5:01:cb:5f:dd:00:3a:1b:d4:80:c5:f8:da:74:4a:d4:89:0c:68:2e:57:74:90:75:01:c4:b2:dc:47:f5
Signer

Actual PE Digest

e9:3e:b5:01:cb:5f:dd:00:3a:1b:d4:80:c5:f8:da:74:4a:d4:89:0c:68:2e:57:74:90:75:01:c4:b2:dc:47:f5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\des\NxDes64.pdb

Imports

kernel32

FormatMessageW
GetVersionExW
HeapDestroy
LeaveCriticalSection
GetFileAttributesA
HeapCreate
HeapValidate
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
DeleteCriticalSection
GetCurrentThreadId
OutputDebugStringA
GetVersionExA
DeleteFileW
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
CopyFileA
ResetEvent
CreateEventW
ExitProcess
SetErrorMode
GetModuleFileNameW
OpenMutexW
GetSystemDirectoryW
CopyFileW
SleepEx
QueueUserAPC
WideCharToMultiByte
GetStringTypeW
GetEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
SetStdHandle
LCMapStringW
InitializeCriticalSection
FormatMessageA
UnlockFileEx
OutputDebugStringW
WaitForSingleObjectEx
LockFile
FlushViewOfFile
GetConsoleMode
GetConsoleCP
GetVersion
HeapSetInformation
GetFileType
InitializeCriticalSectionAndSpinCount
SetHandleCount
RtlUnwindEx
FlsAlloc
FlsFree
FlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
RtlPcToFileHeader
RaiseException
GetCommandLineA
FlsSetValue
CreateThread
GetLocalTime
GetSystemTimeAsFileTime
ExitThread
DecodePointer
EncodePointer
WriteProcessMemory
VirtualProtect
SetUnhandledExceptionFilter
GetSystemDirectoryA
lstrlenW
WriteConsoleW
UnlockFile
HeapFree
QueryPerformanceCounter
SystemTimeToFileTime
HeapAlloc
SetEndOfFile
UnmapViewOfFile
MapViewOfFile
TryEnterCriticalSection
SetFilePointer
HeapCompact
GetFileSize
HeapReAlloc
GetFullPathNameA
GetFullPathNameW
GetProcAddress
GetStdHandle
LoadLibraryW
GetCurrentProcess
FreeLibrary
GetCurrentProcessId
CloseHandle
GetFileAttributesExW
GetFileSizeEx
Sleep
TerminateThread
WriteFile
GetTickCount
SetEvent
CancelIo
DeviceIoControl
WaitForSingleObject
SetFilePointerEx
CreateMutexW
FreeEnvironmentStringsW
CreateFileA
SetEnvironmentVariableA
CompareStringW
GetStartupInfoW
GetModuleFileNameA
GetLogicalDrives
SetFileAttributesW
GetDriveTypeA
GetVolumeInformationA
SetFileAttributesA
GetPrivateProfileStringA
SetLastError
GetModuleHandleW
OpenProcess
lstrcpynW
TerminateProcess
QueryDosDeviceW

user32

GetMessageW
DefWindowProcW
wsprintfA
SendMessageTimeoutW
CharUpperW
RegisterClassExW
TranslateMessage
LoadIconW
LoadCursorW
RegisterWindowMessageW
PostQuitMessage
DispatchMessageA
CreateWindowExW
DestroyWindow

gdi32

GetStockObject

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegOpenKeyExW
RegOpenKeyExA
OpenProcessToken
GetTokenInformation
RegCreateKeyExW
RegQueryValueExA
RegQueryValueExW
LookupPrivilegeValueW
AdjustTokenPrivileges
ConvertSidToStringSidW
RegSetValueExW

shell32

SHCreateDirectoryExW
SHCreateDirectoryExA
SHGetSpecialFolderPathW

shlwapi

SHSetValueA
PathFindFileNameW
StrStrIW
SHGetValueW
PathAppendW
PathMatchSpecW
wnsprintfA
PathFileExistsW
PathFileExistsA
wnsprintfW
SHDeleteValueA
wvnsprintfA
PathAppendA
StrToIntExA
PathFindFileNameA
SHSetValueW

gdiplus

GdiplusStartup

nefs64

RegisterCloseFileNotify
SefsDelAllPolicys
SefsPolicyAddPathName
SefsGlobalNameSet
SefsGlobalNameCleanup
UD_Destory
SefsAddNewPolicy
RegisterCreateFileNotify
UD_Initialize
SefsSetGlobalAccessFlag
SefsCloseModule
SefsOpenModule

iphlpapi

GetAdaptersAddresses

netapi32

Netbios

ws2_32

connect
WSAGetOverlappedResult
inet_addr
WSAGetLastError
htons
socket
closesocket
WSAStartup
WSASend
WSARecv

dbghelp

MiniDumpWriteDump

Exports

Exports

DesMain

Sections

.text
Size: 824KB - Virtual size: 823KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 42KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/NtDesUtil.dll
.dll regsvr32 windows:6 windows x86 arch:x86

9fabe9c16306f27500d95d22d94758da

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9e:cf:47:60:d1:7b:eb:ce:53:5b:fa:62:04:16:81:83:16:23:53:81:14:01:a1:d7:7d:2d:b1:57:09:6f:d6:f4
Signer

Actual PE Digest

9e:cf:47:60:d1:7b:eb:ce:53:5b:fa:62:04:16:81:83:16:23:53:81:14:01:a1:d7:7d:2d:b1:57:09:6f:d6:f4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\UM_FESF\Release\NtDesUtil.pdb

Imports

ntdll

RtlUnwind
NtCreateFile

kernel32

EncodePointer
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
lstrcmpiW
MultiByteToWideChar
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
GetVolumePathNamesForVolumeNameW
CloseHandle
DeviceIoControl
WaitForSingleObject
OpenEventW
FindResourceExW
LockResource
LocalFree
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetConsoleMode
GetConsoleOutputCP
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
CreateFileW
WriteConsoleW
WriteFile
FlushFileBuffers
SetStdHandle
SetFilePointerEx
GetStringTypeW
LCMapStringW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
IsDebuggerPresent
OutputDebugStringW
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType

user32

CharNextW

advapi32

ConvertStringSidToSidW
RegQueryValueExW
GetLengthSid
CopySid
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

ole32

CoCreateInstance
CoTaskMemFree
CoCreateFreeThreadedMarshaler
StringFromGUID2
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

SafeArrayGetVartype
SafeArrayCopy
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayCreate
SysAllocStringByteLen
SysStringByteLen
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysAllocString
SysFreeString
VariantClear
SysStringLen

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/NtDeshs.exe
.exe windows:5 windows x86 arch:x86

69d3a0269c04dbed3e233d758e9461a7

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6b:b4:b2:f6:02:8a:fe:a8:c9:ee:18:3d:24:ad:87:ee:ad:f7:9a:1e:3e:89:77:f4:96:a6:23:fc:6c:e9:d1:d7
Signer

Actual PE Digest

6b:b4:b2:f6:02:8a:fe:a8:c9:ee:18:3d:24:ad:87:ee:ad:f7:9a:1e:3e:89:77:f4:96:a6:23:fc:6c:e9:d1:d7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\Release\Client\NtDeshs.pdb

Imports

kernel32

CopyFileExW
MoveFileExW
SetFileAttributesW
GetFileAttributesW
SetLastError
CreateThread
SetEvent
Sleep
CreateEventW
GetCurrentThreadId
InterlockedCompareExchange
GetCurrentProcess
GetCommandLineW
InterlockedExchange
LocalFree
CloseHandle
DeleteFileW
GetCurrentThread
ReleaseMutex
WaitForSingleObject
CreateMutexW
LoadLibraryExW
lstrcmpiW
InterlockedIncrement
FreeLibrary
GetModuleHandleW
GetProcessHeap
DeleteCriticalSection
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
FindResourceW
LoadResource
RaiseException
HeapReAlloc
WriteConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
VirtualQuery
VirtualProtect
VirtualAlloc
GetSystemInfo
RtlUnwind
GetLastError
MultiByteToWideChar
HeapSize
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
GetModuleFileNameW
InterlockedDecrement
EnterCriticalSection
HeapFree
SizeofResource
GetTickCount
OpenProcess
CreateFileW
FindClose
WideCharToMultiByte
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
OutputDebugStringW
GetModuleFileNameA
GetFileSizeEx
WriteFile
OutputDebugStringA
CreateFileA
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
SetFilePointerEx
FindNextFileW

user32

GetMessageW
CharUpperW
MessageBoxW
LoadStringW
DispatchMessageW
TranslateMessage
PostThreadMessageW
CharNextW
wsprintfA

advapi32

InitializeSid
InitializeAcl
DuplicateToken
ConvertSidToStringSidW
GetLengthSid
GetSecurityDescriptorLength
MakeSelfRelativeSD
GetTokenInformation
DeregisterEventSource
CreateServiceW
CloseServiceHandle
GetSecurityDescriptorSacl
RevertToSelf
GetSecurityDescriptorDacl
GetAclInformation
GetAce
EqualSid
AllocateAndInitializeSid
GetSecurityDescriptorGroup
GetSidSubAuthority
GetSidLengthRequired
GetSecurityDescriptorControl
CopySid
OpenSCManagerW
GetSecurityDescriptorOwner
IsValidSid
AddAce
SetThreadToken
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegEnumKeyExW
RegCreateKeyExW
RegDeleteKeyW
RegQueryInfoKeyW
RegCloseKey
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
ImpersonateSelf
GetNamedSecurityInfoW
SetNamedSecurityInfoW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegQueryValueExW
ReportEventW
RegisterEventSourceW
OpenServiceW
StartServiceCtrlDispatcherW
OpenProcessToken
ControlService
RegisterServiceCtrlHandlerW
DeleteService
SetServiceStatus
CheckTokenMembership

ole32

CoAddRefServerProcess
CoReleaseServerProcess
StringFromGUID2
CoUninitialize
CoCreateInstance
CoRevertToSelf
CoResumeClassObjects
CoInitializeSecurity
CoInitializeEx
CoRevokeClassObject
CoTaskMemAlloc
CoImpersonateClient
CoTaskMemRealloc
CoTaskMemFree
CoRegisterClassObject

oleaut32

SysAllocString
SafeArrayLock
SafeArrayGetVartype
SafeArrayCopy
SafeArrayGetLBound
SafeArrayUnlock
SafeArrayGetUBound
VariantInit
SafeArrayDestroy
VariantClear
LoadRegTypeLi
LoadTypeLi
SysFreeString
SysStringLen
VarUI4FromStr
UnRegisterTypeLi
SafeArrayCreate
RegisterTypeLi

shlwapi

PathFindFileNameA
wvnsprintfA
PathIsNetworkPathW
SHSetValueA
wnsprintfW
wnsprintfA
PathFileExistsW

userenv

UnloadUserProfile

shell32

SHCreateDirectoryExA

Sections

.text
Size: 292KB - Virtual size: 291KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 94KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/NtDeshs2.dll
.dll windows:5 windows x86 arch:x86

3b5a28717114f214f43b9cfe3d4488c0

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

05:51:34:91:ed:f8:f6:79:9c:15:4b:b8:6b:d2:9e:dc:bd:83:b8:01:47:5a:29:0f:0a:52:bf:ae:9e:47:ad:d8
Signer

Actual PE Digest

05:51:34:91:ed:f8:f6:79:9c:15:4b:b8:6b:d2:9e:dc:bd:83:b8:01:47:5a:29:0f:0a:52:bf:ae:9e:47:ad:d8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\NtDeshs2.pdb

Imports

kernel32

HeapFree
InterlockedDecrement
InitializeCriticalSectionAndSpinCount
HeapSize
GetLastError
DisableThreadLibraryCalls
HeapReAlloc
RaiseException
HeapAlloc
DecodePointer
DeleteCriticalSection
GetProcessHeap
CreateFileW
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WriteFile
SetStdHandle
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
LocalFree
CloseHandle
CreateEventW
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwind
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType
GetStringTypeW

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SysFreeString
SysAllocString

Exports

Exports

DesUtilIsEncryptedFile

Sections

.text
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/WinNtDes.dll
.dll windows:5 windows x86 arch:x86

cba13a981532ad239d9b1d1c198912df

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f6:37:5b:c9:34:19:a3:66:a0:5f:7c:cc:f9:0d:e8:26:97:da:df:c4:14:57:04:cf:bb:d6:f3:74:ea:e0:8e:a6
Signer

Actual PE Digest

f6:37:5b:c9:34:19:a3:66:a0:5f:7c:cc:f9:0d:e8:26:97:da:df:c4:14:57:04:cf:bb:d6:f3:74:ea:e0:8e:a6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\WinNtDes.pdb

Imports

kernel32

InterlockedDecrement
GetWindowsDirectoryW
GetModuleFileNameW
OpenEventW
CreateEventW
WaitForSingleObjectEx
SleepEx
WaitForSingleObject
QueueUserAPC
TerminateThread
OpenProcess
GetTickCount
DisableThreadLibraryCalls
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
QueueUserWorkItem
Sleep
CloseHandle
OpenThread
GetProcessIdOfThread
DeleteCriticalSection
GetSystemDirectoryW
GetLastError
RaiseException
GetProcessHeap
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
InterlockedExchangeAdd
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
SystemTimeToTzSpecificLocalTime
InitializeCriticalSectionAndSpinCount
MoveFileExW
CreateDirectoryW
SetStdHandle
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
SetConsoleCtrlHandler
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
WriteConsoleW
GetFileType
GetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
ExitProcess
InterlockedFlushSList
RtlUnwind
ReleaseMutex
HeapDestroy
DecodePointer
WideCharToMultiByte
FormatMessageW
MultiByteToWideChar
EncodePointer
SetLastError
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
OutputDebugStringW
LocalFree
GetModuleFileNameA
GetFileSizeEx
WriteFile
OutputDebugStringA
CreateFileA
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
SetFilePointerEx
ReadFile
QueryDosDeviceW
GetLogicalDrives
FindFirstFileW
FindNextFileW
lstrcpynW
DeviceIoControl
GetDriveTypeA
SetFilePointer
SetEndOfFile
GetTempPathW
FindClose
GetVolumeInformationA
LocalAlloc
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
GetModuleHandleA
SetFileAttributesW
GetFileAttributesExW
FileTimeToSystemTime
DeleteFileA
DeleteFileW
LoadLibraryW
FreeLibrary
CreateFileMappingW
MapViewOfFile
LoadLibraryExW
lstrlenW
GetFileSize
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
InterlockedCompareExchange
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
CreateMutexW
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
LoadLibraryA
GetVersionExA
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
WritePrivateProfileStringA
GetComputerNameW
CreateDirectoryA
GetPrivateProfileStringA
GetVolumeInformationW
GetDiskFreeSpaceExW
GetDriveTypeW
OpenFileMappingW
OpenMutexW
GetCurrentDirectoryW

user32

CharUpperW
wsprintfW
GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
wsprintfA

ole32

CoInitializeEx
CoCreateInstance

oleaut32

SafeArrayGetVartype
SysFreeString
SysAllocString
SafeArrayDestroy
SysStringLen
VariantClear
VariantInit
SysAllocStringLen
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound

shlwapi

SHSetValueA
PathFindFileNameA
PathAppendA
PathFileExistsA
wvnsprintfA
PathAppendW
wnsprintfW
PathFindFileNameW
StrToIntExA
wnsprintfA
SHDeleteValueA
PathFileExistsW
PathMatchSpecW
SHSetValueW

winntdes.exe

FePolSetConfiguration

ws2_32

WSAIoctl
shutdown
WSACleanup
WSAStartup
WSAGetLastError
setsockopt
htons
recv
connect
socket
inet_addr
WSASetLastError
WSACreateEvent
getnameinfo
ioctlsocket
sendto
WSACloseEvent
closesocket
bind
gethostname
inet_ntoa
gethostbyname
ntohs
recvfrom
getsockopt
freeaddrinfo
getaddrinfo
listen
htonl
accept
select
send
WSAEnumNetworkEvents
WSAEventSelect
getpeername
getsockname
__WSAFDIsSet

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW

crypt32

CryptMsgClose
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertDuplicateCertificateContext
CertGetNameStringW
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFindCertificateInStore

wintrust

CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseContext
WinVerifyTrust

netapi32

Netbios

rpcrt4

UuidFromStringA

iphlpapi

GetAdaptersAddresses

wldap32

ord208
ord41
ord117
ord26
ord27
ord127
ord167
ord14
ord46
ord145
ord142
ord79
ord133
ord147
ord301
ord216
ord219

advapi32

RegOpenKeyExW
OpenProcessToken
RegSetValueExW
GetTokenInformation
RegCreateKeyExW
SetEntriesInAclW
AllocateAndInitializeSid
RegQueryValueExA
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExA
InitializeSecurityDescriptor
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupPrivilegeValueW
SetSecurityDescriptorDacl
AdjustTokenPrivileges
RegCloseKey
SetFileSecurityW

shell32

SHCreateDirectoryExA
SHGetSpecialFolderPathW
SHCreateDirectoryExW

Exports

Exports

PolicyDllInit
PurgePolicyCacheFile

Sections

.text
Size: 2.5MB - Virtual size: 2.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 536KB - Virtual size: 535KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 43KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 95KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/WinNtDes.exe
.exe windows:6 windows x86 arch:x86

ed20d79e863d18ffa7f7193acedd4a6a

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

12:3b:85:01:7a:ba:43:21:a8:a0:2c:3a:a1:5c:54:8f:10:ef:fa:d1:84:5d:f5:ed:49:6f:23:2c:7a:60:35:33
Signer

Actual PE Digest

12:3b:85:01:7a:ba:43:21:a8:a0:2c:3a:a1:5c:54:8f:10:ef:fa:d1:84:5d:f5:ed:49:6f:23:2c:7a:60:35:33

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\UM_FESF\Release\WinNtDes.pdb

Imports

kernel32

GetProcAddress
LocalFree
FreeLibrary
SetConsoleCtrlHandler
DebugBreak
GetOverlappedResult
lstrlenW
GetModuleFileNameW
FormatMessageW
GetTimeFormatW
GetDateFormatW
SetEndOfFile
ResetEvent
CreateThread
LoadLibraryW
CloseHandle
SetEvent
GetLastError
CreateEventW
ReleaseMutex
CreateFileW
LocalAlloc
WaitForSingleObject
CreateMutexW
WaitForMultipleObjects
DeviceIoControl
SetLastError
FlushFileBuffers
CancelIo
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetFileType
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
GetFileSizeEx
SetFilePointerEx
GetConsoleOutputCP
GetConsoleMode
HeapSize
ReadFile
ReadConsoleW
WriteConsoleW

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW
RegSetValueExW
RegDeleteValueW
SetSecurityDescriptorDacl
RegCloseKey
AllocateAndInitializeSid
SetEntriesInAclW
RegCreateKeyExW
FreeSid
InitializeSecurityDescriptor
RegQueryValueExW

Exports

Exports

FePolSetConfiguration

Sections

.text
Size: 155KB - Virtual size: 154KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/WinNtDs.exe
.exe windows:6 windows x86 arch:x86

3f9ed384dd89065bcf3f65c0b7757e26

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c2:bf:98:67:9b:8a:f5:44:01:44:38:51:e8:54:35:67:c1:a2:1a:50:71:60:ba:27:59:b5:9e:fd:ef:77:63:0d
Signer

Actual PE Digest

c2:bf:98:67:9b:8a:f5:44:01:44:38:51:e8:54:35:67:c1:a2:1a:50:71:60:ba:27:59:b5:9e:fd:ef:77:63:0d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\UM_FESF\Release\WinNtDs.pdb

Imports

ntdll

NtQueryEaFile
RtlNtStatusToDosError
NtSetEaFile
RtlUnwind
NtQueryInformationFile
NtCreateFile

kernel32

FlushFileBuffers
GetFileSizeEx
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
DeviceIoControl
GetCurrentThreadId
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
CreateThread
Sleep
CreateEventW
WaitForSingleObject
SetEvent
DecodePointer
GetCommandLineW
MultiByteToWideChar
ReplaceFileW
lstrcmpiW
LocalFree
FindResourceW
SizeofResource
LockResource
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
FindResourceExW
GetCurrentThread
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
SetLastError
GetLastError
RaiseException
CloseHandle
SetFileTime
SetFileAttributesW
GetFileTime
GetFileAttributesW
WriteConsoleW
DeleteFileW
CreateFileW
SetStdHandle
GetStringTypeW
GetConsoleOutputCP
GetConsoleMode
FreeEnvironmentStringsW
FindFirstFileExW
FindClose
LCMapStringW
GetFileType
GetStdHandle
GetModuleHandleExW
ExitProcess
VirtualQuery
VirtualProtect
VirtualAlloc
GetSystemInfo
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringW
IsDebuggerPresent

user32

DispatchMessageW
MessageBoxW
CharUpperW
PostThreadMessageW
LoadStringW
TranslateMessage
GetMessageW
CharNextW

advapi32

ControlService
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
OpenServiceW
OpenSCManagerW
DeleteService
CreateServiceW
CloseServiceHandle
RegQueryValueExW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
SetNamedSecurityInfoW
GetNamedSecurityInfoW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
LookupPrivilegeValueW
RevertToSelf
MakeSelfRelativeSD
IsValidSid
InitializeSid
InitializeAcl
ImpersonateSelf
GetTokenInformation
GetSidSubAuthority
GetSidLengthRequired
GetSecurityDescriptorSacl
GetSecurityDescriptorOwner
GetSecurityDescriptorLength
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
GetLengthSid
GetAclInformation
GetAce
EqualSid
CopySid
AdjustTokenPrivileges
AddAce
OpenThreadToken
SetThreadToken

ole32

CoCreateFreeThreadedMarshaler
CoRevertToSelf
CoCreateInstance
StringFromGUID2
CoCreateGuid
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoUninitialize
CoInitializeEx
CoRegisterClassObject
CoResumeClassObjects
CoImpersonateClient
CoAddRefServerProcess
CoReleaseServerProcess
CoInitializeSecurity
CoRevokeClassObject

oleaut32

SysStringLen
SysAllocString
SysAllocStringLen
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
VarBstrCat
VarUI4FromStr
VariantClear
SafeArrayGetVartype
SafeArrayCopy
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayCreate
SysAllocStringByteLen
SysStringByteLen
SysFreeString

userenv

UnloadUserProfile

Sections

.text
Size: 134KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/drivers/ntdes/arm/nxdds2.cat
plugins/nxd/la/drivers/ntdes/arm/nxdds2.dll
.sys windows:10 windows x86 arch:x86

a987da14ee144397f2b1a701f480aef3

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f3:00:b9:a0:80:cd:e5:a6:32:99:f3:d5:85:19:ea:a6:5e:e7:76:3d:a4:c6:37:00:ef:de:ef:19:9f:8a:86:49
Signer

Actual PE Digest

f3:00:b9:a0:80:cd:e5:a6:32:99:f3:d5:85:19:ea:a6:5e:e7:76:3d:a4:c6:37:00:ef:de:ef:19:9f:8a:86:49

Digest Algorithm

sha256

PE Digest Matches

true

f3:00:b9:a0:80:cd:e5:a6:32:99:f3:d5:85:19:ea:a6:5e:e7:76:3d:a4:c6:37:00:ef:de:ef:19:9f:8a:86:49
Signer

Actual PE Digest

f3:00:b9:a0:80:cd:e5:a6:32:99:f3:d5:85:19:ea:a6:5e:e7:76:3d:a4:c6:37:00:ef:de:ef:19:9f:8a:86:49

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\OneDLP\NxDes\Src\Release\NxdDs2.pdb

Imports

fltmgr.sys

FltAllocateContext
FltSetInstanceContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetStreamContext
FltGetStreamHandleContext
FltReferenceContext
FltReleaseContext
FltSetCallbackDataDirty
FltQueryVolumeInformationFile
FltCancelFileOpen
FltFindExtraCreateParameter
FltReleaseFileNameInformation
FltParseFileNameInformation
FltCreateFile
FltClose
FltGetUpperInstance
FltObjectDereference
FltAllocateExtraCreateParameterList
FltRemoveExtraCreateParameter
FltFreeExtraCreateParameterList
FltFreeExtraCreateParameter
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltDetachVolume
FltGetDeviceObject
FltQueryInformationFile
FltFsControlFile
FltSetInformationFile
FltAllocateCallbackData
FltFreeCallbackData
FltPerformSynchronousIo
FltAllocateCallbackDataEx
FltReuseCallbackData
FltQueryVolumeInformation
FltReadFile
FltWriteFile
FltGetFileNameInformationUnsafe
FltAllocateExtraCreateParameter
FltGetEcpListFromCallbackData
FltSetEcpListIntoCallbackData
FltGetRoutineAddress
FltCreateFileEx2
FltOplockFsctrl
FltCheckOplock

ntoskrnl.exe

PsGetCurrentThreadId
FsRtlIsPagingFile
memset
DbgPrint
ExRaiseStatus
ExIsResourceAcquiredExclusiveLite
memcpy
KeGetCurrentThread
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
ProbeForWrite
MmProbeAndLockPages
ExFreePoolWithTag
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
ObfDereferenceObject
ZwClose
SeTokenType
SeCreateClientSecurity
SeImpersonateClientEx
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
PsRevertToSelf
ObOpenObjectByPointer
FsRtlInsertExtraCreateParameter
IoFileObjectType
SeSinglePrivilegeCheck
SeExports
RtlInitUnicodeString
RtlGetVersion
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlEqualUnicodeString
KeDelayExecutionThread
KeAreAllApcsDisabled
IoGetCurrentProcess
ExAcquireResourceExclusiveLite
ExSetResourceOwnerPointer
ExIsResourceAcquiredSharedLite
KeExpandKernelStackAndCalloutEx
ExAcquireSharedStarveExclusive
RtlCompareMemory
_aullrem
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
IoAllocateIrp
IofCallDriver
IoFreeIrp
ObReferenceObjectByHandle
ZwCreateFile
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeAreApcsDisabled
ExReleaseResourceForThreadLite
MmIsDriverVerifying
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
FsRtlAllocateExtraCreateParameter
FsRtlIsEcpFromUserMode
FsRtlAreVolumeStartupApplicationsComplete
FsRtlIsNtstatusExpected
RtlQueryRegistryValues
RtlIsNtDdiVersionAvailable
IoGetTransactionParameterBlock
ExAcquireResourceSharedLite
ExReleaseResourceLite
ObfReferenceObject
IoGetLowerDeviceObject
IoGetDeviceAttachmentBaseRef
KeBugCheckEx
ExAllocatePoolWithTag
RtlUnwind
MmUnlockPages

hal

KeGetCurrentIrql

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/drivers/ntdes/arm/nxdds2.inf
plugins/nxd/la/drivers/ntdes/arm/nxddt2.cat
plugins/nxd/la/drivers/ntdes/arm/nxddt2.dll
.sys windows:10 windows x86 arch:x86

a29db00eb8e37eef263da8ff410c4485

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

55:e2:94:41:9f:2b:5d:10:12:fd:13:1d:a3:f6:26:b9:c6:4e:8b:64:67:2c:53:75:26:2a:15:65:30:b0:87:69
Signer

Actual PE Digest

55:e2:94:41:9f:2b:5d:10:12:fd:13:1d:a3:f6:26:b9:c6:4e:8b:64:67:2c:53:75:26:2a:15:65:30:b0:87:69

Digest Algorithm

sha256

PE Digest Matches

true

55:e2:94:41:9f:2b:5d:10:12:fd:13:1d:a3:f6:26:b9:c6:4e:8b:64:67:2c:53:75:26:2a:15:65:30:b0:87:69
Signer

Actual PE Digest

55:e2:94:41:9f:2b:5d:10:12:fd:13:1d:a3:f6:26:b9:c6:4e:8b:64:67:2c:53:75:26:2a:15:65:30:b0:87:69

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\OneDLP\NxDes\Src\Release\NxdDt2.pdb

Imports

cng.sys

BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDestroyKey
BCryptDecrypt
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGetProperty
BCryptDestroyHash
BCryptOpenAlgorithmProvider

fltmgr.sys

FltInsertExtraCreateParameter
FltIsVolumeSnapshot
FltGetDestinationFileNameInformation
FltPerformSynchronousIo
FltFreeCallbackData
FltCheckOplock
FltOplockFsctrl
FltGetRoutineAddress
FltSetEcpListIntoCallbackData
FltGetVolumeGuidName
FltGetFileNameInformationUnsafe
FltGetVolumeFromInstance
FltAllocateCallbackData
FltAllocateContext
FltSetInstanceContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetStreamContext
FltGetStreamHandleContext
FltReferenceContext
FltReleaseContext
FltSetCallbackDataDirty
FltGetFileNameInformation
FltReleaseFileNameInformation
FltParseFileNameInformation
FltCreateFileEx2
FltWriteFile
FltSetInformationFile
FltQueryVolumeInformationFile
FltFlushBuffers
FltFsControlFile
FltReissueSynchronousIo
FltClose
FltCancelFileOpen
FltAllocateExtraCreateParameterList
FltAllocateExtraCreateParameter
FltGetUpperInstance
FltFindExtraCreateParameter
FltRemoveExtraCreateParameter
FltFreeExtraCreateParameterList
FltFreeExtraCreateParameter
FltGetEcpListFromCallbackData
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltAttachVolume
FltDetachVolume
FltGetFilterFromName
FltGetVolumeInstanceFromName
FltGetDiskDeviceObject
FltGetInstanceInformation
FltObjectDereference
FltLoadFilter
FltQueryInformationFile
FltGetRequestorProcess

ntoskrnl.exe

PsLookupThreadByThreadId
PsGetThreadProcess
memset
KeReadStateEvent
KeSetEvent
KeWaitForSingleObject
ExIsResourceAcquiredExclusiveLite
IofCompleteRequest
IoCsqInsertIrp
IoCsqRemoveNextIrp
FsRtlCancellableWaitForSingleObject
memcpy
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
PsSetCreateProcessNotifyRoutineEx
KeInitializeEvent
KeClearEvent
IoAllocateErrorLogEntry
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoWriteErrorLogEntry
IoCsqInitialize
PsGetCurrentProcessId
PsGetThreadProcessId
InitSafeBootMode
PsGetThreadId
DbgPrint
FsRtlIsPagingFile
RtlEqualUnicodeString
RtlIsNtDdiVersionAvailable
KeAreAllApcsDisabled
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExSetResourceOwnerPointerEx
IoGetCurrentProcess
ZwClose
ZwCreateSection
FsRtlFreeExtraCreateParameter
FsRtlInsertExtraCreateParameter
FsRtlFindExtraCreateParameter
FsRtlRemoveExtraCreateParameter
PsInitialSystemProcess
RtlCompareMemory
MmMapLockedPagesSpecifyCache
ZwCreateKey
ZwOpenKey
ZwEnumerateValueKey
ZwQueryValueKey
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
SeSinglePrivilegeCheck
SeExports
RtlInitUnicodeString
RtlGetVersion
MmGetSystemRoutineAddress
SeCaptureSubjectContext
SeReleaseSubjectContext
IoWMIRegistrationControl
ExUuidCreate
FsRtlGetNextExtraCreateParameter
MmProbeAndLockPages
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoFreeMdl
RtlUpcaseUnicodeChar
TmGetTransactionId
ObQueryNameString
_stricmp
RtlUpperChar
RtlPrefixUnicodeString
IoVolumeDeviceToDosName
FsRtlAreNamesEqual
PsGetProcessImageFileName
KeGetCurrentThread
IoAllocateIrp
IofCallDriver
IoFreeIrp
ObReferenceObjectByHandle
ZwCreateFile
IoFileObjectType
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeAreApcsDisabled
ExReleaseResourceForThreadLite
MmIsDriverVerifying
FsRtlIsNameInExpression
KdDebuggerNotPresent
KdDebuggerEnabled
RtlQueryRegistryValues
RtlGUIDFromString
FsRtlAllocateExtraCreateParameter
FsRtlIsEcpFromUserMode
FsRtlAreVolumeStartupApplicationsComplete
memmove
IoGetTransactionParameterBlock
FsRtlIsNtstatusExpected
KeBugCheckEx
RtlSetDaclSecurityDescriptor
RtlUnwind
ObfDereferenceObject
ExIsResourceAcquiredSharedLite
ExFreePoolWithTag
ExAllocatePoolWithTag
PsGetCurrentThreadId
RtlFreeUnicodeString
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
ObOpenObjectByPointer
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
ZwSetValueKey

hal

KfAcquireSpinLock
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
KfReleaseSpinLock
KeGetCurrentIrql

Sections

.text
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/drivers/ntdes/arm/nxddt2.inf
plugins/nxd/la/drivers/ntdes/arm/nxdisolate.cat
plugins/nxd/la/drivers/ntdes/arm/nxdisolate.dll
.sys windows:10 windows x86 arch:x86

5f69159c4d7f354a1e3ed5509cda720d

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:b3:51:e4:72:d7:1f:ba:0e:60:ec:bd:1b:44:70:5f:7f:92:7f:5c:74:fe:45:7c:ba:37:5c:7e:af:33:f9:75
Signer

Actual PE Digest

5f:b3:51:e4:72:d7:1f:ba:0e:60:ec:bd:1b:44:70:5f:7f:92:7f:5c:74:fe:45:7c:ba:37:5c:7e:af:33:f9:75

Digest Algorithm

sha256

PE Digest Matches

true

5f:b3:51:e4:72:d7:1f:ba:0e:60:ec:bd:1b:44:70:5f:7f:92:7f:5c:74:fe:45:7c:ba:37:5c:7e:af:33:f9:75
Signer

Actual PE Digest

5f:b3:51:e4:72:d7:1f:ba:0e:60:ec:bd:1b:44:70:5f:7f:92:7f:5c:74:fe:45:7c:ba:37:5c:7e:af:33:f9:75

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\OneDLP\NxDes\Src\Release\NxdIsolate.pdb

Imports

fltmgr.sys

FltSetCallbackDataDirty
FltReleaseContext
FltQueryInformationFile
FltSetInformationFile
FltClose
FltDetachVolume
FltAllocateContext
FltSetInstanceContext
FltSetFileContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetFileContext
FltGetStreamContext
FltGetStreamHandleContext
FltFreeFileLock
FltParseFileNameInformation
FltCreateFileEx
FltFsControlFile
FltCancelFileOpen
FltOplockFsctrl
FltFindExtraCreateParameter
FltAllocateExtraCreateParameterList
FltRemoveExtraCreateParameter
FltGetNextExtraCreateParameter
FltReleaseFileNameInformation
FltFreeExtraCreateParameterList
FltGetEcpListFromCallbackData
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltGetDeviceObject
FltGetDiskDeviceObject
FltIsVolumeWritable
FltIsVolumeSnapshot
FltQueryVolumeInformation
FltCompletePendedPreOperation
FltIsIoCanceled
FltCompletePendedPostOperation
FltAllocateCallbackData
FltFreeCallbackData
FltReuseCallbackData
FltPerformSynchronousIo
FltAllocateFileLock
FltProcessFileLock
FltGetRequestorProcess
FltCheckAndGrowNameControl
FltGetFileNameInformation
FltGetFileNameInformationUnsafe
FltQueryDirectoryFile
FltCheckOplock
FltOplockIsFastIoPossible
FltOplockBreakH
FltOplockIsSharedRequest
FltReissueSynchronousIo
FltCheckLockForReadAccess
FltIsOperationSynchronous
FltGetDestinationFileNameInformation
FltWriteFile
FltGetVolumeFromInstance
FltGetTopInstance
FltObjectDereference
FltCheckLockForWriteAccess
FltGetRoutineAddress
FltCreateFileEx2

ntoskrnl.exe

KeWaitForSingleObject
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
ExIsResourceAcquiredExclusiveLite
ExIsResourceAcquiredSharedLite
MmGetSystemRoutineAddress
IoGetStackLimits
ObfReferenceObject
ObfDereferenceObject
ObDereferenceObjectDeferDelete
PsGetCurrentThreadId
PsIsSystemThread
MmCanFileBeTruncated
FsRtlIsNtstatusExpected
FsRtlChangeBackingFileObject
CcInitializeCacheMap
CcUninitializeCacheMap
CcPurgeCacheSection
CcFlushCache
CcGetFileObjectFromSectionPtrsRef
CcSetReadAheadGranularity
CcSetAdditionalCacheAttributes
memset
RtlFreeUnicodeString
RtlStringFromGUID
KeQuerySystemTime
ExAllocatePoolWithTag
ExFreePoolWithTag
ExGetPreviousMode
KeDelayExecutionThread
CcSetFileSizes
memcpy
ExInitializeResourceLite
ExDeleteResourceLite
FsRtlUninitializeOplock
FsRtlTeardownPerFileContexts
FsRtlTeardownPerStreamContexts
RtlEqualUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
KeClearEvent
MmDoesFileHaveUserWritableReferences
KeExpandKernelStackAndCalloutEx
IoIsFileObjectIgnoringSharing
FsRtlCurrentBatchOplock
FsRtlInsertExtraCreateParameter
SeTokenType
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
FsRtlDissectName
IoGetCurrentProcess
ObReferenceObjectByHandle
SeSinglePrivilegeCheck
NtClose
KeStackAttachProcess
KeUnstackDetachProcess
IoAcquireVpbSpinLock
IoReleaseVpbSpinLock
ObOpenObjectByPointer
IoFileObjectType
SeExports
RtlInitUnicodeString
RtlGetVersion
IoWMIRegistrationControl
PsGetCurrentProcessId
FsRtlGetNextFileLock
FsRtlFastUnlockSingle
FsRtlFastUnlockAll
FsRtlFastUnlockAllByKey
FsRtlPrivateLock
KeAreApcsDisabled
KeAreAllApcsDisabled
MmFlushImageSection
CcZeroData
MmForceSectionClosed
ExRaiseStatus
IoGetTopLevelIrp
SeCreateClientSecurity
SeImpersonateClientEx
PsRevertToSelf
FsRtlInitializeOplock
FsRtlOplockKeysEqual
FsRtlIsPagingFile
MmMapLockedPagesSpecifyCache
FsRtlMdlReadCompleteDev
CcCopyRead
CcMdlRead
FsRtlCurrentOplockH
RtlCompareMemory
CcSetFileSizesEx
ExReleaseResourceForThreadLite
MmProbeAndLockPages
IoAllocateMdl
IoFreeMdl
PsGetThreadProcessId
FsRtlMdlWriteCompleteDev
FsRtlFastCheckLockForRead
FsRtlFastCheckLockForWrite
CcCanIWrite
CcDeferWrite
CcCopyWrite
CcPrepareMdlWrite
IoAllocateIrp
IofCallDriver
IoFreeIrp
ZwCreateFile
ZwClose
DbgPrint
KeEnterCriticalRegion
KeLeaveCriticalRegion
MmIsDriverVerifying
FsRtlIsNameInExpression
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
IoGetLowerDeviceObject
IoGetDeviceAttachmentBaseRef
IoGetTransactionParameterBlock
RtlQueryRegistryValues
KeBugCheckEx
KeGetCurrentThread
RtlUnwind
KeSetEvent
KeReadStateEvent
KeInitializeEvent
RtlIsNtDdiVersionAvailable
ExUuidCreate

hal

KfAcquireSpinLock
KeGetCurrentIrql
ExReleaseFastMutex
ExAcquireFastMutex
KfReleaseSpinLock

Sections

.text
Size: 198KB - Virtual size: 198KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/drivers/ntdes/arm/nxdisolate.inf
plugins/nxd/la/drivers/ntdes/arm/nxdsupport.cat
plugins/nxd/la/drivers/ntdes/arm/nxdsupport.dll
.sys windows:10 windows x86 arch:x86

3b4f8fcffae4aa5d6e0cecf9b1224253

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c6:ae:15:3c:2c:78:56:2e:a4:f0:be:f7:35:a6:a0:dc:8d:ec:a5:e9:25:f0:83:91:c8:3f:30:bd:39:9f:2b:2e
Signer

Actual PE Digest

c6:ae:15:3c:2c:78:56:2e:a4:f0:be:f7:35:a6:a0:dc:8d:ec:a5:e9:25:f0:83:91:c8:3f:30:bd:39:9f:2b:2e

Digest Algorithm

sha256

PE Digest Matches

true

c6:ae:15:3c:2c:78:56:2e:a4:f0:be:f7:35:a6:a0:dc:8d:ec:a5:e9:25:f0:83:91:c8:3f:30:bd:39:9f:2b:2e
Signer

Actual PE Digest

c6:ae:15:3c:2c:78:56:2e:a4:f0:be:f7:35:a6:a0:dc:8d:ec:a5:e9:25:f0:83:91:c8:3f:30:bd:39:9f:2b:2e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\OneDLP\NxDes\Src\Release\NxdSupport.pdb

Imports

fltmgr.sys

FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltReleaseFileNameInformation
FltGetVolumeName
FltCreateFileEx
FltClose
FltIsVolumeSnapshot
FltObjectReference
FltObjectDereference
FltAllocateCallbackData
FltFreeCallbackData
FltReuseCallbackData
FltPerformSynchronousIo
FltReadFile
FltGetRoutineAddress
FltOplockFsctrl
FltCheckOplock
FltGetFileNameInformationUnsafe
FltGetVolumeGuidName

ntoskrnl.exe

ExAcquireSharedStarveExclusive
ExReleaseResourceLite
ExConvertExclusiveToSharedLite
ExDeleteResourceLite
memset
KeGetCurrentThread
KeDelayExecutionThread
KeAreApcsDisabled
ExAllocatePoolWithTag
ExFreePoolWithTag
PsGetCurrentThreadId
RtlInitUnicodeString
RtlWriteRegistryValue
RtlUnicodeStringToAnsiString
RtlEqualUnicodeString
RtlFreeUnicodeString
RtlStringFromGUID
RtlGetVersion
MmGetSystemRoutineAddress
IoWMIRegistrationControl
ExUuidCreate
memcpy
KeInitializeEvent
KeClearEvent
KeReadStateEvent
KeSetEvent
KeSetPriorityThread
KeWaitForSingleObject
KeQuerySystemTime
KeQueryActiveProcessorCount
ExAcquireSpinLockShared
ExReleaseSpinLockShared
ExAcquireSpinLockExclusiveAtDpcLevel
ExAcquireSpinLockExclusive
ExReleaseSpinLockExclusiveFromDpcLevel
ExReleaseSpinLockExclusive
PsCreateSystemThread
PsTerminateSystemThread
ZwClose
KeInitializeQueue
KeInsertQueue
KeRemoveQueue
KeRundownQueue
ZwWaitForSingleObject
_alldiv
_aulldiv
RtlCopyUnicodeString
PsSetCreateThreadNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
ObOpenObjectByPointer
PsProcessType
RtlIntegerToUnicodeString
ExAcquireResourceExclusiveLite
IoAllocateErrorLogEntry
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoWriteErrorLogEntry
ObfDereferenceObject
ObDereferenceObjectDeferDelete
PsSetCreateProcessNotifyRoutineEx
PsGetThreadProcessId
ZwOpenProcess
RtlValidSid
RtlEqualSid
RtlLengthRequiredSid
RtlConvertSidToUnicodeString
PsLookupProcessByProcessId
PsLookupThreadByThreadId
ZwOpenProcessTokenEx
ZwOpenThreadTokenEx
ZwQueryInformationToken
PsGetProcessExitProcessCalled
ZwOpenThread
PsInitialSystemProcess
ExIsResourceAcquiredExclusiveLite
RtlPrefixUnicodeString
memmove
KeWaitForMultipleObjects
KeBugCheckEx
CcWaitForCurrentLazyWriterActivity
_allmul
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmIsDriverVerifying
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
RtlQueryRegistryValues
RtlIsNtDdiVersionAvailable
FsRtlIsNtstatusExpected
RtlGUIDFromString
FsRtlAreVolumeStartupApplicationsComplete
DbgPrint
RtlUnwind
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeExports
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
RtlSetDaclSecurityDescriptor
ZwOpenKey
ZwSetValueKey
ZwQueryValueKey
ZwCreateKey
ExAcquireResourceSharedLite
ExInitializeResourceLite
KeLeaveCriticalRegion
KeEnterCriticalRegion
RtlAppendUnicodeStringToString

hal

KfAcquireSpinLock
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
KeGetCurrentIrql
KfReleaseSpinLock

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/drivers/ntdes/arm/nxdsupport.inf
plugins/nxd/la/drivers/ntdes/arm64/nxdds2.cat
plugins/nxd/la/drivers/ntdes/arm64/nxdds2.dll
.sys windows:10 windows x64 arch:x64

440e884cef29057b85ca41b8ba129d93

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

53:28:34:b3:fb:8f:46:ae:b8:c3:7d:1a:a3:61:a8:71:ee:96:1a:69:7c:92:44:19:97:ec:3e:dd:c5:42:ef:2f
Signer

Actual PE Digest

53:28:34:b3:fb:8f:46:ae:b8:c3:7d:1a:a3:61:a8:71:ee:96:1a:69:7c:92:44:19:97:ec:3e:dd:c5:42:ef:2f

Digest Algorithm

sha256

PE Digest Matches

true

53:28:34:b3:fb:8f:46:ae:b8:c3:7d:1a:a3:61:a8:71:ee:96:1a:69:7c:92:44:19:97:ec:3e:dd:c5:42:ef:2f
Signer

Actual PE Digest

53:28:34:b3:fb:8f:46:ae:b8:c3:7d:1a:a3:61:a8:71:ee:96:1a:69:7c:92:44:19:97:ec:3e:dd:c5:42:ef:2f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\OneDLP\NxDes\Src\x64\Release\NxdDs2.pdb

Imports

fltmgr.sys

FltAllocateContext
FltSetInstanceContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetStreamContext
FltGetStreamHandleContext
FltReferenceContext
FltReleaseContext
FltSetCallbackDataDirty
FltQueryVolumeInformationFile
FltCancelFileOpen
FltFindExtraCreateParameter
FltReleaseFileNameInformation
FltParseFileNameInformation
FltCreateFile
FltClose
FltGetUpperInstance
FltObjectDereference
FltAllocateExtraCreateParameterList
FltRemoveExtraCreateParameter
FltFreeExtraCreateParameterList
FltFreeExtraCreateParameter
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltDetachVolume
FltGetDeviceObject
FltQueryInformationFile
FltFsControlFile
FltSetInformationFile
FltAllocateCallbackData
FltFreeCallbackData
FltPerformSynchronousIo
FltAllocateCallbackDataEx
FltReuseCallbackData
FltQueryVolumeInformation
FltReadFile
FltWriteFile
FltGetFileNameInformationUnsafe
FltAllocateExtraCreateParameter
FltGetEcpListFromCallbackData
FltSetEcpListIntoCallbackData
FltGetRoutineAddress
FltCreateFileEx2
FltOplockFsctrl
FltCheckOplock

ntoskrnl.exe

ExAllocatePoolWithTag
ExFreePoolWithTag
PsGetCurrentThreadId
FsRtlIsPagingFile
DbgPrint
ExRaiseStatus
ExIsResourceAcquiredExclusiveLite
__C_specific_handler
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
ProbeForWrite
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
ObfDereferenceObject
ZwClose
SeTokenType
SeCreateClientSecurity
SeImpersonateClientEx
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
PsRevertToSelf
ObOpenObjectByPointer
FsRtlInsertExtraCreateParameter
IoFileObjectType
SeSinglePrivilegeCheck
SeExports
RtlInitUnicodeString
RtlGetVersion
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlEqualUnicodeString
KeDelayExecutionThread
KeAreAllApcsDisabled
IoGetCurrentProcess
ExAcquireResourceExclusiveLite
ExSetResourceOwnerPointer
ExIsResourceAcquiredSharedLite
KeExpandKernelStackAndCalloutEx
ExAcquireSharedStarveExclusive
RtlCompareMemory
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
IoAllocateIrp
IofCallDriver
IoFreeIrp
ObReferenceObjectByHandle
ZwCreateFile
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeAreApcsDisabled
ExReleaseResourceForThreadLite
MmIsDriverVerifying
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
FsRtlAllocateExtraCreateParameter
FsRtlIsEcpFromUserMode
FsRtlAreVolumeStartupApplicationsComplete
FsRtlIsNtstatusExpected
RtlQueryRegistryValues
RtlIsNtDdiVersionAvailable
IoGetTransactionParameterBlock
ExAcquireResourceSharedLite
ExReleaseResourceLite
ObfReferenceObject
IoGetLowerDeviceObject
IoGetDeviceAttachmentBaseRef
KeBugCheckEx

Sections

.text
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/drivers/ntdes/arm64/nxdds2.inf
plugins/nxd/la/drivers/ntdes/arm64/nxddt2.cat
plugins/nxd/la/drivers/ntdes/arm64/nxddt2.dll
.sys windows:10 windows x64 arch:x64

ed1876dde5e29a4c5c83e3b70fb01ca6

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

aa:9a:bd:0c:01:b8:25:32:19:7e:46:1e:5e:71:46:e7:e2:88:1a:37:6a:3b:e6:5c:ac:9f:7f:b7:1b:41:2a:d6
Signer

Actual PE Digest

aa:9a:bd:0c:01:b8:25:32:19:7e:46:1e:5e:71:46:e7:e2:88:1a:37:6a:3b:e6:5c:ac:9f:7f:b7:1b:41:2a:d6

Digest Algorithm

sha256

PE Digest Matches

true

aa:9a:bd:0c:01:b8:25:32:19:7e:46:1e:5e:71:46:e7:e2:88:1a:37:6a:3b:e6:5c:ac:9f:7f:b7:1b:41:2a:d6
Signer

Actual PE Digest

aa:9a:bd:0c:01:b8:25:32:19:7e:46:1e:5e:71:46:e7:e2:88:1a:37:6a:3b:e6:5c:ac:9f:7f:b7:1b:41:2a:d6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\OneDLP\NxDes\Src\x64\Release\NxdDt2.pdb

Imports

cng.sys

BCryptDecrypt
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGetProperty

fltmgr.sys

FltAllocateExtraCreateParameterList
FltCheckOplock
FltOplockFsctrl
FltGetRoutineAddress
FltSetEcpListIntoCallbackData
FltGetVolumeGuidName
FltGetFileNameInformationUnsafe
FltGetVolumeFromInstance
FltGetRequestorProcess
FltIsVolumeSnapshot
FltGetDestinationFileNameInformation
FltPerformSynchronousIo
FltFreeCallbackData
FltAllocateContext
FltSetInstanceContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetStreamContext
FltGetStreamHandleContext
FltReferenceContext
FltReleaseContext
FltSetCallbackDataDirty
FltGetFileNameInformation
FltReleaseFileNameInformation
FltParseFileNameInformation
FltCreateFileEx2
FltWriteFile
FltSetInformationFile
FltQueryVolumeInformationFile
FltFlushBuffers
FltFsControlFile
FltReissueSynchronousIo
FltClose
FltCancelFileOpen
FltGetUpperInstance
FltAllocateExtraCreateParameter
FltInsertExtraCreateParameter
FltFindExtraCreateParameter
FltRemoveExtraCreateParameter
FltFreeExtraCreateParameterList
FltFreeExtraCreateParameter
FltGetEcpListFromCallbackData
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltAttachVolume
FltDetachVolume
FltGetFilterFromName
FltGetVolumeInstanceFromName
FltGetDiskDeviceObject
FltGetInstanceInformation
FltObjectDereference
FltLoadFilter
FltQueryInformationFile
FltAllocateCallbackData

ntoskrnl.exe

ExAllocatePoolWithTag
ExFreePoolWithTag
ExIsResourceAcquiredSharedLite
ObfDereferenceObject
PsSetCreateProcessNotifyRoutineEx
PsGetCurrentThreadId
PsLookupThreadByThreadId
PsGetThreadProcess
KeReadStateEvent
KeSetEvent
KeWaitForSingleObject
ExIsResourceAcquiredExclusiveLite
IofCompleteRequest
IoCsqInsertIrp
IoCsqRemoveNextIrp
FsRtlCancellableWaitForSingleObject
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlFreeUnicodeString
KeInitializeEvent
KeClearEvent
IoAllocateErrorLogEntry
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoWriteErrorLogEntry
IoCsqInitialize
PsGetCurrentProcessId
PsGetThreadProcessId
InitSafeBootMode
PsGetThreadId
DbgPrint
FsRtlIsPagingFile
RtlEqualUnicodeString
RtlIsNtDdiVersionAvailable
KeAreAllApcsDisabled
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExSetResourceOwnerPointerEx
IoGetCurrentProcess
ZwClose
ZwCreateSection
FsRtlFreeExtraCreateParameter
FsRtlInsertExtraCreateParameter
FsRtlFindExtraCreateParameter
FsRtlRemoveExtraCreateParameter
PsInitialSystemProcess
RtlCompareMemory
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
MmMapLockedPagesSpecifyCache
ZwCreateKey
ZwOpenKey
ZwEnumerateValueKey
ZwQueryValueKey
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
SeSinglePrivilegeCheck
SeExports
RtlInitUnicodeString
RtlGetVersion
MmGetSystemRoutineAddress
SeCaptureSubjectContext
SeReleaseSubjectContext
IoWMIRegistrationControl
ExUuidCreate
FsRtlGetNextExtraCreateParameter
MmProbeAndLockPages
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoFreeMdl
__C_specific_handler
RtlUpcaseUnicodeChar
TmGetTransactionId
ObQueryNameString
_stricmp
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
RtlUpperChar
RtlPrefixUnicodeString
IoVolumeDeviceToDosName
FsRtlAreNamesEqual
PsGetProcessImageFileName
IoAllocateIrp
IofCallDriver
IoFreeIrp
ObReferenceObjectByHandle
ZwCreateFile
IoFileObjectType
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeAreApcsDisabled
ExReleaseResourceForThreadLite
MmIsDriverVerifying
FsRtlIsNameInExpression
KdDebuggerNotPresent
KdDebuggerEnabled
RtlQueryRegistryValues
RtlGUIDFromString
FsRtlAllocateExtraCreateParameter
FsRtlIsEcpFromUserMode
FsRtlAreVolumeStartupApplicationsComplete
IoGetTransactionParameterBlock
FsRtlIsNtstatusExpected
KeBugCheckEx
RtlSetDaclSecurityDescriptor
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
ObOpenObjectByPointer
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
ZwSetValueKey

Sections

.text
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/drivers/ntdes/arm64/nxddt2.inf
plugins/nxd/la/drivers/ntdes/arm64/nxdisolate.cat
plugins/nxd/la/drivers/ntdes/arm64/nxdisolate.dll
.sys windows:10 windows x64 arch:x64

3115605e5b9a2e654dd7ef6d8181afbf

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:3a:d8:79:77:e6:bf:11:a2:db:95:be:21:22:25:b7:df:7a:aa:d4:b4:f1:fc:93:19:3d:98:39:f8:ce:07:9c
Signer

Actual PE Digest

71:3a:d8:79:77:e6:bf:11:a2:db:95:be:21:22:25:b7:df:7a:aa:d4:b4:f1:fc:93:19:3d:98:39:f8:ce:07:9c

Digest Algorithm

sha256

PE Digest Matches

true

71:3a:d8:79:77:e6:bf:11:a2:db:95:be:21:22:25:b7:df:7a:aa:d4:b4:f1:fc:93:19:3d:98:39:f8:ce:07:9c
Signer

Actual PE Digest

71:3a:d8:79:77:e6:bf:11:a2:db:95:be:21:22:25:b7:df:7a:aa:d4:b4:f1:fc:93:19:3d:98:39:f8:ce:07:9c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\OneDLP\NxDes\Src\x64\Release\NxdIsolate.pdb

Imports

fltmgr.sys

FltSetCallbackDataDirty
FltReleaseContext
FltQueryInformationFile
FltSetInformationFile
FltClose
FltDetachVolume
FltAllocateContext
FltSetInstanceContext
FltSetFileContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetFileContext
FltGetStreamContext
FltGetStreamHandleContext
FltFreeFileLock
FltParseFileNameInformation
FltCreateFileEx
FltFsControlFile
FltCancelFileOpen
FltOplockFsctrl
FltFindExtraCreateParameter
FltAllocateExtraCreateParameterList
FltRemoveExtraCreateParameter
FltGetNextExtraCreateParameter
FltReleaseFileNameInformation
FltFreeExtraCreateParameterList
FltGetEcpListFromCallbackData
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltGetDeviceObject
FltGetDiskDeviceObject
FltIsVolumeWritable
FltIsVolumeSnapshot
FltQueryVolumeInformation
FltCompletePendedPreOperation
FltIsIoCanceled
FltIs32bitProcess
FltCompletePendedPostOperation
FltAllocateCallbackData
FltFreeCallbackData
FltReuseCallbackData
FltPerformSynchronousIo
FltAllocateFileLock
FltProcessFileLock
FltGetRequestorProcess
FltCheckAndGrowNameControl
FltGetFileNameInformation
FltGetFileNameInformationUnsafe
FltQueryDirectoryFile
FltCheckOplock
FltOplockIsFastIoPossible
FltOplockBreakH
FltOplockIsSharedRequest
FltReissueSynchronousIo
FltCheckLockForReadAccess
FltIsOperationSynchronous
FltGetDestinationFileNameInformation
FltWriteFile
FltGetVolumeFromInstance
FltGetTopInstance
FltObjectDereference
FltCheckLockForWriteAccess
FltGetRoutineAddress
FltCreateFileEx2

ntoskrnl.exe

RtlIsNtDdiVersionAvailable
KeInitializeEvent
KeReadStateEvent
KeSetEvent
KeDelayExecutionThread
KeWaitForSingleObject
ExAcquireFastMutex
ExReleaseFastMutex
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
ExIsResourceAcquiredExclusiveLite
ExIsResourceAcquiredSharedLite
MmGetSystemRoutineAddress
IoGetStackLimits
ObfReferenceObject
ObfDereferenceObject
ObDereferenceObjectDeferDelete
PsGetCurrentThreadId
PsIsSystemThread
MmCanFileBeTruncated
FsRtlIsNtstatusExpected
FsRtlChangeBackingFileObject
CcInitializeCacheMap
CcUninitializeCacheMap
CcPurgeCacheSection
CcFlushCache
CcGetFileObjectFromSectionPtrsRef
CcSetReadAheadGranularity
CcSetAdditionalCacheAttributes
__C_specific_handler
RtlFreeUnicodeString
RtlStringFromGUID
ExAllocatePoolWithTag
ExFreePoolWithTag
ExGetPreviousMode
ExUuidCreate
CcSetFileSizes
ExInitializeResourceLite
ExDeleteResourceLite
FsRtlUninitializeOplock
FsRtlTeardownPerFileContexts
FsRtlTeardownPerStreamContexts
RtlEqualUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
KeClearEvent
MmDoesFileHaveUserWritableReferences
KeExpandKernelStackAndCalloutEx
IoIsFileObjectIgnoringSharing
FsRtlCurrentBatchOplock
FsRtlInsertExtraCreateParameter
SeTokenType
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
FsRtlDissectName
IoGetCurrentProcess
ObReferenceObjectByHandle
SeSinglePrivilegeCheck
NtClose
KeStackAttachProcess
KeUnstackDetachProcess
IoAcquireVpbSpinLock
IoReleaseVpbSpinLock
ObOpenObjectByPointer
IoFileObjectType
SeExports
RtlInitUnicodeString
RtlGetVersion
IoWMIRegistrationControl
PsGetCurrentProcessId
FsRtlGetNextFileLock
FsRtlFastUnlockSingle
FsRtlFastUnlockAll
FsRtlFastUnlockAllByKey
FsRtlPrivateLock
KeAreApcsDisabled
KeAreAllApcsDisabled
MmFlushImageSection
CcZeroData
MmForceSectionClosed
ExRaiseStatus
IoGetTopLevelIrp
SeCreateClientSecurity
SeImpersonateClientEx
PsRevertToSelf
FsRtlInitializeOplock
FsRtlOplockKeysEqual
FsRtlIsPagingFile
MmMapLockedPagesSpecifyCache
FsRtlMdlReadCompleteDev
CcCopyRead
CcMdlRead
FsRtlCurrentOplockH
RtlCompareMemory
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
CcSetFileSizesEx
ExReleaseResourceForThreadLite
MmProbeAndLockPages
IoAllocateMdl
IoFreeMdl
PsGetThreadProcessId
FsRtlMdlWriteCompleteDev
FsRtlFastCheckLockForRead
FsRtlFastCheckLockForWrite
CcCanIWrite
CcDeferWrite
CcCopyWrite
CcPrepareMdlWrite
IoAllocateIrp
IofCallDriver
IoFreeIrp
ZwCreateFile
ZwClose
DbgPrint
KeEnterCriticalRegion
KeLeaveCriticalRegion
MmIsDriverVerifying
FsRtlIsNameInExpression
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
IoGetLowerDeviceObject
IoGetDeviceAttachmentBaseRef
IoGetTransactionParameterBlock
RtlQueryRegistryValues
KeBugCheckEx

Sections

.text
Size: 246KB - Virtual size: 246KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/drivers/ntdes/arm64/nxdisolate.inf
plugins/nxd/la/drivers/ntdes/arm64/nxdsupport.cat
plugins/nxd/la/drivers/ntdes/arm64/nxdsupport.dll
.sys windows:10 windows x64 arch:x64

70113bc4633c30e4c01a6af6138e5492

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cd:a2:e2:d7:53:6b:9b:c3:56:95:77:fe:11:a0:de:23:d1:98:76:d7:c1:a8:e7:c3:f4:38:6f:66:4c:ab:33:e9
Signer

Actual PE Digest

cd:a2:e2:d7:53:6b:9b:c3:56:95:77:fe:11:a0:de:23:d1:98:76:d7:c1:a8:e7:c3:f4:38:6f:66:4c:ab:33:e9

Digest Algorithm

sha256

PE Digest Matches

true

cd:a2:e2:d7:53:6b:9b:c3:56:95:77:fe:11:a0:de:23:d1:98:76:d7:c1:a8:e7:c3:f4:38:6f:66:4c:ab:33:e9
Signer

Actual PE Digest

cd:a2:e2:d7:53:6b:9b:c3:56:95:77:fe:11:a0:de:23:d1:98:76:d7:c1:a8:e7:c3:f4:38:6f:66:4c:ab:33:e9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\OneDLP\NxDes\Src\x64\Release\NxdSupport.pdb

Imports

fltmgr.sys

FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltReleaseFileNameInformation
FltGetVolumeName
FltCreateFileEx
FltClose
FltIsVolumeSnapshot
FltObjectReference
FltObjectDereference
FltAllocateCallbackData
FltFreeCallbackData
FltReuseCallbackData
FltPerformSynchronousIo
FltReadFile
FltGetRoutineAddress
FltOplockFsctrl
FltCheckOplock
FltGetFileNameInformationUnsafe
FltGetVolumeGuidName

ntoskrnl.exe

DbgPrint
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
ExConvertExclusiveToSharedLite
ExDeleteResourceLite
KeDelayExecutionThread
KeAreApcsDisabled
ExAllocatePoolWithTag
ExFreePoolWithTag
PsGetCurrentThreadId
RtlInitUnicodeString
RtlWriteRegistryValue
RtlUnicodeStringToAnsiString
RtlEqualUnicodeString
RtlFreeUnicodeString
RtlStringFromGUID
RtlGetVersion
MmGetSystemRoutineAddress
IoWMIRegistrationControl
ExUuidCreate
KeInitializeEvent
KeClearEvent
KeReadStateEvent
KeSetEvent
KeSetPriorityThread
KeWaitForSingleObject
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
KeQueryActiveProcessorCount
ExAcquireSpinLockShared
ExReleaseSpinLockShared
ExAcquireSpinLockExclusiveAtDpcLevel
ExAcquireSpinLockExclusive
ExReleaseSpinLockExclusiveFromDpcLevel
ExReleaseSpinLockExclusive
PsCreateSystemThread
PsTerminateSystemThread
ZwClose
KeInitializeQueue
KeInsertQueue
KeRemoveQueue
KeRundownQueue
ZwWaitForSingleObject
__C_specific_handler
RtlCopyUnicodeString
PsSetCreateThreadNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
ObOpenObjectByPointer
PsProcessType
RtlIntegerToUnicodeString
RtlAppendUnicodeStringToString
IoAllocateErrorLogEntry
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoWriteErrorLogEntry
ObfDereferenceObject
ObDereferenceObjectDeferDelete
PsSetCreateProcessNotifyRoutineEx
PsGetThreadProcessId
ZwOpenProcess
RtlValidSid
RtlEqualSid
RtlLengthRequiredSid
RtlConvertSidToUnicodeString
PsLookupProcessByProcessId
PsLookupThreadByThreadId
ZwOpenProcessTokenEx
ZwOpenThreadTokenEx
ZwQueryInformationToken
PsGetProcessExitProcessCalled
ZwOpenThread
PsInitialSystemProcess
ExIsResourceAcquiredExclusiveLite
RtlPrefixUnicodeString
KeWaitForMultipleObjects
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeBugCheckEx
CcWaitForCurrentLazyWriterActivity
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmIsDriverVerifying
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
RtlQueryRegistryValues
RtlIsNtDdiVersionAvailable
FsRtlIsNtstatusExpected
RtlGUIDFromString
FsRtlAreVolumeStartupApplicationsComplete
ZwQueryValueKey
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeExports
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
RtlSetDaclSecurityDescriptor
ZwOpenKey
ZwSetValueKey
ZwCreateKey

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/drivers/ntdes/arm64/nxdsupport.inf
plugins/nxd/la/drivers/ntdes/x64/nxdds2.cat
plugins/nxd/la/drivers/ntdes/x64/nxdds2.inf
plugins/nxd/la/drivers/ntdes/x64/nxdds2.sys
.sys windows:10 windows x64 arch:x64

440e884cef29057b85ca41b8ba129d93

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

53:28:34:b3:fb:8f:46:ae:b8:c3:7d:1a:a3:61:a8:71:ee:96:1a:69:7c:92:44:19:97:ec:3e:dd:c5:42:ef:2f
Signer

Actual PE Digest

53:28:34:b3:fb:8f:46:ae:b8:c3:7d:1a:a3:61:a8:71:ee:96:1a:69:7c:92:44:19:97:ec:3e:dd:c5:42:ef:2f

Digest Algorithm

sha256

PE Digest Matches

true

53:28:34:b3:fb:8f:46:ae:b8:c3:7d:1a:a3:61:a8:71:ee:96:1a:69:7c:92:44:19:97:ec:3e:dd:c5:42:ef:2f
Signer

Actual PE Digest

53:28:34:b3:fb:8f:46:ae:b8:c3:7d:1a:a3:61:a8:71:ee:96:1a:69:7c:92:44:19:97:ec:3e:dd:c5:42:ef:2f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\OneDLP\NxDes\Src\x64\Release\NxdDs2.pdb

Imports

fltmgr.sys

FltAllocateContext
FltSetInstanceContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetStreamContext
FltGetStreamHandleContext
FltReferenceContext
FltReleaseContext
FltSetCallbackDataDirty
FltQueryVolumeInformationFile
FltCancelFileOpen
FltFindExtraCreateParameter
FltReleaseFileNameInformation
FltParseFileNameInformation
FltCreateFile
FltClose
FltGetUpperInstance
FltObjectDereference
FltAllocateExtraCreateParameterList
FltRemoveExtraCreateParameter
FltFreeExtraCreateParameterList
FltFreeExtraCreateParameter
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltDetachVolume
FltGetDeviceObject
FltQueryInformationFile
FltFsControlFile
FltSetInformationFile
FltAllocateCallbackData
FltFreeCallbackData
FltPerformSynchronousIo
FltAllocateCallbackDataEx
FltReuseCallbackData
FltQueryVolumeInformation
FltReadFile
FltWriteFile
FltGetFileNameInformationUnsafe
FltAllocateExtraCreateParameter
FltGetEcpListFromCallbackData
FltSetEcpListIntoCallbackData
FltGetRoutineAddress
FltCreateFileEx2
FltOplockFsctrl
FltCheckOplock

ntoskrnl.exe

ExAllocatePoolWithTag
ExFreePoolWithTag
PsGetCurrentThreadId
FsRtlIsPagingFile
DbgPrint
ExRaiseStatus
ExIsResourceAcquiredExclusiveLite
__C_specific_handler
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
ProbeForWrite
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
ObfDereferenceObject
ZwClose
SeTokenType
SeCreateClientSecurity
SeImpersonateClientEx
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
PsRevertToSelf
ObOpenObjectByPointer
FsRtlInsertExtraCreateParameter
IoFileObjectType
SeSinglePrivilegeCheck
SeExports
RtlInitUnicodeString
RtlGetVersion
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlEqualUnicodeString
KeDelayExecutionThread
KeAreAllApcsDisabled
IoGetCurrentProcess
ExAcquireResourceExclusiveLite
ExSetResourceOwnerPointer
ExIsResourceAcquiredSharedLite
KeExpandKernelStackAndCalloutEx
ExAcquireSharedStarveExclusive
RtlCompareMemory
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
IoAllocateIrp
IofCallDriver
IoFreeIrp
ObReferenceObjectByHandle
ZwCreateFile
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeAreApcsDisabled
ExReleaseResourceForThreadLite
MmIsDriverVerifying
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
FsRtlAllocateExtraCreateParameter
FsRtlIsEcpFromUserMode
FsRtlAreVolumeStartupApplicationsComplete
FsRtlIsNtstatusExpected
RtlQueryRegistryValues
RtlIsNtDdiVersionAvailable
IoGetTransactionParameterBlock
ExAcquireResourceSharedLite
ExReleaseResourceLite
ObfReferenceObject
IoGetLowerDeviceObject
IoGetDeviceAttachmentBaseRef
KeBugCheckEx

Sections

.text
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/drivers/ntdes/x64/nxddt2.cat
plugins/nxd/la/drivers/ntdes/x64/nxddt2.inf
plugins/nxd/la/drivers/ntdes/x64/nxddt2.sys
.sys windows:10 windows x64 arch:x64

ed1876dde5e29a4c5c83e3b70fb01ca6

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

aa:9a:bd:0c:01:b8:25:32:19:7e:46:1e:5e:71:46:e7:e2:88:1a:37:6a:3b:e6:5c:ac:9f:7f:b7:1b:41:2a:d6
Signer

Actual PE Digest

aa:9a:bd:0c:01:b8:25:32:19:7e:46:1e:5e:71:46:e7:e2:88:1a:37:6a:3b:e6:5c:ac:9f:7f:b7:1b:41:2a:d6

Digest Algorithm

sha256

PE Digest Matches

true

aa:9a:bd:0c:01:b8:25:32:19:7e:46:1e:5e:71:46:e7:e2:88:1a:37:6a:3b:e6:5c:ac:9f:7f:b7:1b:41:2a:d6
Signer

Actual PE Digest

aa:9a:bd:0c:01:b8:25:32:19:7e:46:1e:5e:71:46:e7:e2:88:1a:37:6a:3b:e6:5c:ac:9f:7f:b7:1b:41:2a:d6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\OneDLP\NxDes\Src\x64\Release\NxdDt2.pdb

Imports

cng.sys

BCryptDecrypt
BCryptDestroyHash
BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDestroyKey
BCryptOpenAlgorithmProvider
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGetProperty

fltmgr.sys

FltAllocateExtraCreateParameterList
FltCheckOplock
FltOplockFsctrl
FltGetRoutineAddress
FltSetEcpListIntoCallbackData
FltGetVolumeGuidName
FltGetFileNameInformationUnsafe
FltGetVolumeFromInstance
FltGetRequestorProcess
FltIsVolumeSnapshot
FltGetDestinationFileNameInformation
FltPerformSynchronousIo
FltFreeCallbackData
FltAllocateContext
FltSetInstanceContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetStreamContext
FltGetStreamHandleContext
FltReferenceContext
FltReleaseContext
FltSetCallbackDataDirty
FltGetFileNameInformation
FltReleaseFileNameInformation
FltParseFileNameInformation
FltCreateFileEx2
FltWriteFile
FltSetInformationFile
FltQueryVolumeInformationFile
FltFlushBuffers
FltFsControlFile
FltReissueSynchronousIo
FltClose
FltCancelFileOpen
FltGetUpperInstance
FltAllocateExtraCreateParameter
FltInsertExtraCreateParameter
FltFindExtraCreateParameter
FltRemoveExtraCreateParameter
FltFreeExtraCreateParameterList
FltFreeExtraCreateParameter
FltGetEcpListFromCallbackData
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltAttachVolume
FltDetachVolume
FltGetFilterFromName
FltGetVolumeInstanceFromName
FltGetDiskDeviceObject
FltGetInstanceInformation
FltObjectDereference
FltLoadFilter
FltQueryInformationFile
FltAllocateCallbackData

ntoskrnl.exe

ExAllocatePoolWithTag
ExFreePoolWithTag
ExIsResourceAcquiredSharedLite
ObfDereferenceObject
PsSetCreateProcessNotifyRoutineEx
PsGetCurrentThreadId
PsLookupThreadByThreadId
PsGetThreadProcess
KeReadStateEvent
KeSetEvent
KeWaitForSingleObject
ExIsResourceAcquiredExclusiveLite
IofCompleteRequest
IoCsqInsertIrp
IoCsqRemoveNextIrp
FsRtlCancellableWaitForSingleObject
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
RtlFreeUnicodeString
KeInitializeEvent
KeClearEvent
IoAllocateErrorLogEntry
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoWriteErrorLogEntry
IoCsqInitialize
PsGetCurrentProcessId
PsGetThreadProcessId
InitSafeBootMode
PsGetThreadId
DbgPrint
FsRtlIsPagingFile
RtlEqualUnicodeString
RtlIsNtDdiVersionAvailable
KeAreAllApcsDisabled
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExSetResourceOwnerPointerEx
IoGetCurrentProcess
ZwClose
ZwCreateSection
FsRtlFreeExtraCreateParameter
FsRtlInsertExtraCreateParameter
FsRtlFindExtraCreateParameter
FsRtlRemoveExtraCreateParameter
PsInitialSystemProcess
RtlCompareMemory
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
MmMapLockedPagesSpecifyCache
ZwCreateKey
ZwOpenKey
ZwEnumerateValueKey
ZwQueryValueKey
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
SeSinglePrivilegeCheck
SeExports
RtlInitUnicodeString
RtlGetVersion
MmGetSystemRoutineAddress
SeCaptureSubjectContext
SeReleaseSubjectContext
IoWMIRegistrationControl
ExUuidCreate
FsRtlGetNextExtraCreateParameter
MmProbeAndLockPages
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoFreeMdl
__C_specific_handler
RtlUpcaseUnicodeChar
TmGetTransactionId
ObQueryNameString
_stricmp
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
RtlUpperChar
RtlPrefixUnicodeString
IoVolumeDeviceToDosName
FsRtlAreNamesEqual
PsGetProcessImageFileName
IoAllocateIrp
IofCallDriver
IoFreeIrp
ObReferenceObjectByHandle
ZwCreateFile
IoFileObjectType
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeAreApcsDisabled
ExReleaseResourceForThreadLite
MmIsDriverVerifying
FsRtlIsNameInExpression
KdDebuggerNotPresent
KdDebuggerEnabled
RtlQueryRegistryValues
RtlGUIDFromString
FsRtlAllocateExtraCreateParameter
FsRtlIsEcpFromUserMode
FsRtlAreVolumeStartupApplicationsComplete
IoGetTransactionParameterBlock
FsRtlIsNtstatusExpected
KeBugCheckEx
RtlSetDaclSecurityDescriptor
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
ObOpenObjectByPointer
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
ZwSetValueKey

Sections

.text
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 328B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/drivers/ntdes/x64/nxdisolate.cat
plugins/nxd/la/drivers/ntdes/x64/nxdisolate.inf
plugins/nxd/la/drivers/ntdes/x64/nxdisolate.sys
.sys windows:10 windows x64 arch:x64

3115605e5b9a2e654dd7ef6d8181afbf

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

71:3a:d8:79:77:e6:bf:11:a2:db:95:be:21:22:25:b7:df:7a:aa:d4:b4:f1:fc:93:19:3d:98:39:f8:ce:07:9c
Signer

Actual PE Digest

71:3a:d8:79:77:e6:bf:11:a2:db:95:be:21:22:25:b7:df:7a:aa:d4:b4:f1:fc:93:19:3d:98:39:f8:ce:07:9c

Digest Algorithm

sha256

PE Digest Matches

true

71:3a:d8:79:77:e6:bf:11:a2:db:95:be:21:22:25:b7:df:7a:aa:d4:b4:f1:fc:93:19:3d:98:39:f8:ce:07:9c
Signer

Actual PE Digest

71:3a:d8:79:77:e6:bf:11:a2:db:95:be:21:22:25:b7:df:7a:aa:d4:b4:f1:fc:93:19:3d:98:39:f8:ce:07:9c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\OneDLP\NxDes\Src\x64\Release\NxdIsolate.pdb

Imports

fltmgr.sys

FltSetCallbackDataDirty
FltReleaseContext
FltQueryInformationFile
FltSetInformationFile
FltClose
FltDetachVolume
FltAllocateContext
FltSetInstanceContext
FltSetFileContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetFileContext
FltGetStreamContext
FltGetStreamHandleContext
FltFreeFileLock
FltParseFileNameInformation
FltCreateFileEx
FltFsControlFile
FltCancelFileOpen
FltOplockFsctrl
FltFindExtraCreateParameter
FltAllocateExtraCreateParameterList
FltRemoveExtraCreateParameter
FltGetNextExtraCreateParameter
FltReleaseFileNameInformation
FltFreeExtraCreateParameterList
FltGetEcpListFromCallbackData
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltGetDeviceObject
FltGetDiskDeviceObject
FltIsVolumeWritable
FltIsVolumeSnapshot
FltQueryVolumeInformation
FltCompletePendedPreOperation
FltIsIoCanceled
FltIs32bitProcess
FltCompletePendedPostOperation
FltAllocateCallbackData
FltFreeCallbackData
FltReuseCallbackData
FltPerformSynchronousIo
FltAllocateFileLock
FltProcessFileLock
FltGetRequestorProcess
FltCheckAndGrowNameControl
FltGetFileNameInformation
FltGetFileNameInformationUnsafe
FltQueryDirectoryFile
FltCheckOplock
FltOplockIsFastIoPossible
FltOplockBreakH
FltOplockIsSharedRequest
FltReissueSynchronousIo
FltCheckLockForReadAccess
FltIsOperationSynchronous
FltGetDestinationFileNameInformation
FltWriteFile
FltGetVolumeFromInstance
FltGetTopInstance
FltObjectDereference
FltCheckLockForWriteAccess
FltGetRoutineAddress
FltCreateFileEx2

ntoskrnl.exe

RtlIsNtDdiVersionAvailable
KeInitializeEvent
KeReadStateEvent
KeSetEvent
KeDelayExecutionThread
KeWaitForSingleObject
ExAcquireFastMutex
ExReleaseFastMutex
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
ExIsResourceAcquiredExclusiveLite
ExIsResourceAcquiredSharedLite
MmGetSystemRoutineAddress
IoGetStackLimits
ObfReferenceObject
ObfDereferenceObject
ObDereferenceObjectDeferDelete
PsGetCurrentThreadId
PsIsSystemThread
MmCanFileBeTruncated
FsRtlIsNtstatusExpected
FsRtlChangeBackingFileObject
CcInitializeCacheMap
CcUninitializeCacheMap
CcPurgeCacheSection
CcFlushCache
CcGetFileObjectFromSectionPtrsRef
CcSetReadAheadGranularity
CcSetAdditionalCacheAttributes
__C_specific_handler
RtlFreeUnicodeString
RtlStringFromGUID
ExAllocatePoolWithTag
ExFreePoolWithTag
ExGetPreviousMode
ExUuidCreate
CcSetFileSizes
ExInitializeResourceLite
ExDeleteResourceLite
FsRtlUninitializeOplock
FsRtlTeardownPerFileContexts
FsRtlTeardownPerStreamContexts
RtlEqualUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
KeClearEvent
MmDoesFileHaveUserWritableReferences
KeExpandKernelStackAndCalloutEx
IoIsFileObjectIgnoringSharing
FsRtlCurrentBatchOplock
FsRtlInsertExtraCreateParameter
SeTokenType
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
FsRtlDissectName
IoGetCurrentProcess
ObReferenceObjectByHandle
SeSinglePrivilegeCheck
NtClose
KeStackAttachProcess
KeUnstackDetachProcess
IoAcquireVpbSpinLock
IoReleaseVpbSpinLock
ObOpenObjectByPointer
IoFileObjectType
SeExports
RtlInitUnicodeString
RtlGetVersion
IoWMIRegistrationControl
PsGetCurrentProcessId
FsRtlGetNextFileLock
FsRtlFastUnlockSingle
FsRtlFastUnlockAll
FsRtlFastUnlockAllByKey
FsRtlPrivateLock
KeAreApcsDisabled
KeAreAllApcsDisabled
MmFlushImageSection
CcZeroData
MmForceSectionClosed
ExRaiseStatus
IoGetTopLevelIrp
SeCreateClientSecurity
SeImpersonateClientEx
PsRevertToSelf
FsRtlInitializeOplock
FsRtlOplockKeysEqual
FsRtlIsPagingFile
MmMapLockedPagesSpecifyCache
FsRtlMdlReadCompleteDev
CcCopyRead
CcMdlRead
FsRtlCurrentOplockH
RtlCompareMemory
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
CcSetFileSizesEx
ExReleaseResourceForThreadLite
MmProbeAndLockPages
IoAllocateMdl
IoFreeMdl
PsGetThreadProcessId
FsRtlMdlWriteCompleteDev
FsRtlFastCheckLockForRead
FsRtlFastCheckLockForWrite
CcCanIWrite
CcDeferWrite
CcCopyWrite
CcPrepareMdlWrite
IoAllocateIrp
IofCallDriver
IoFreeIrp
ZwCreateFile
ZwClose
DbgPrint
KeEnterCriticalRegion
KeLeaveCriticalRegion
MmIsDriverVerifying
FsRtlIsNameInExpression
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
IoGetLowerDeviceObject
IoGetDeviceAttachmentBaseRef
IoGetTransactionParameterBlock
RtlQueryRegistryValues
KeBugCheckEx

Sections

.text
Size: 246KB - Virtual size: 246KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/drivers/ntdes/x64/nxdsupport.cat
plugins/nxd/la/drivers/ntdes/x64/nxdsupport.inf
plugins/nxd/la/drivers/ntdes/x64/nxdsupport.sys
.sys windows:10 windows x64 arch:x64

70113bc4633c30e4c01a6af6138e5492

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cd:a2:e2:d7:53:6b:9b:c3:56:95:77:fe:11:a0:de:23:d1:98:76:d7:c1:a8:e7:c3:f4:38:6f:66:4c:ab:33:e9
Signer

Actual PE Digest

cd:a2:e2:d7:53:6b:9b:c3:56:95:77:fe:11:a0:de:23:d1:98:76:d7:c1:a8:e7:c3:f4:38:6f:66:4c:ab:33:e9

Digest Algorithm

sha256

PE Digest Matches

true

cd:a2:e2:d7:53:6b:9b:c3:56:95:77:fe:11:a0:de:23:d1:98:76:d7:c1:a8:e7:c3:f4:38:6f:66:4c:ab:33:e9
Signer

Actual PE Digest

cd:a2:e2:d7:53:6b:9b:c3:56:95:77:fe:11:a0:de:23:d1:98:76:d7:c1:a8:e7:c3:f4:38:6f:66:4c:ab:33:e9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\OneDLP\NxDes\Src\x64\Release\NxdSupport.pdb

Imports

fltmgr.sys

FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltReleaseFileNameInformation
FltGetVolumeName
FltCreateFileEx
FltClose
FltIsVolumeSnapshot
FltObjectReference
FltObjectDereference
FltAllocateCallbackData
FltFreeCallbackData
FltReuseCallbackData
FltPerformSynchronousIo
FltReadFile
FltGetRoutineAddress
FltOplockFsctrl
FltCheckOplock
FltGetFileNameInformationUnsafe
FltGetVolumeGuidName

ntoskrnl.exe

DbgPrint
KeEnterCriticalRegion
KeLeaveCriticalRegion
ExInitializeResourceLite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
ExConvertExclusiveToSharedLite
ExDeleteResourceLite
KeDelayExecutionThread
KeAreApcsDisabled
ExAllocatePoolWithTag
ExFreePoolWithTag
PsGetCurrentThreadId
RtlInitUnicodeString
RtlWriteRegistryValue
RtlUnicodeStringToAnsiString
RtlEqualUnicodeString
RtlFreeUnicodeString
RtlStringFromGUID
RtlGetVersion
MmGetSystemRoutineAddress
IoWMIRegistrationControl
ExUuidCreate
KeInitializeEvent
KeClearEvent
KeReadStateEvent
KeSetEvent
KeSetPriorityThread
KeWaitForSingleObject
KeAcquireInStackQueuedSpinLock
KeReleaseInStackQueuedSpinLock
KeQueryActiveProcessorCount
ExAcquireSpinLockShared
ExReleaseSpinLockShared
ExAcquireSpinLockExclusiveAtDpcLevel
ExAcquireSpinLockExclusive
ExReleaseSpinLockExclusiveFromDpcLevel
ExReleaseSpinLockExclusive
PsCreateSystemThread
PsTerminateSystemThread
ZwClose
KeInitializeQueue
KeInsertQueue
KeRemoveQueue
KeRundownQueue
ZwWaitForSingleObject
__C_specific_handler
RtlCopyUnicodeString
PsSetCreateThreadNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
ObOpenObjectByPointer
PsProcessType
RtlIntegerToUnicodeString
RtlAppendUnicodeStringToString
IoAllocateErrorLogEntry
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoWriteErrorLogEntry
ObfDereferenceObject
ObDereferenceObjectDeferDelete
PsSetCreateProcessNotifyRoutineEx
PsGetThreadProcessId
ZwOpenProcess
RtlValidSid
RtlEqualSid
RtlLengthRequiredSid
RtlConvertSidToUnicodeString
PsLookupProcessByProcessId
PsLookupThreadByThreadId
ZwOpenProcessTokenEx
ZwOpenThreadTokenEx
ZwQueryInformationToken
PsGetProcessExitProcessCalled
ZwOpenThread
PsInitialSystemProcess
ExIsResourceAcquiredExclusiveLite
RtlPrefixUnicodeString
KeWaitForMultipleObjects
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
KeBugCheckEx
CcWaitForCurrentLazyWriterActivity
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmIsDriverVerifying
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
RtlQueryRegistryValues
RtlIsNtDdiVersionAvailable
FsRtlIsNtstatusExpected
RtlGUIDFromString
FsRtlAreVolumeStartupApplicationsComplete
ZwQueryValueKey
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeExports
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
RtlSetDaclSecurityDescriptor
ZwOpenKey
ZwSetValueKey
ZwCreateKey

Sections

.text
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

PAGE
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/drivers/ntdes/x86/nxdds2.cat
plugins/nxd/la/drivers/ntdes/x86/nxdds2.inf
plugins/nxd/la/drivers/ntdes/x86/nxdds2.sys
.sys windows:10 windows x86 arch:x86

a987da14ee144397f2b1a701f480aef3

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f3:00:b9:a0:80:cd:e5:a6:32:99:f3:d5:85:19:ea:a6:5e:e7:76:3d:a4:c6:37:00:ef:de:ef:19:9f:8a:86:49
Signer

Actual PE Digest

f3:00:b9:a0:80:cd:e5:a6:32:99:f3:d5:85:19:ea:a6:5e:e7:76:3d:a4:c6:37:00:ef:de:ef:19:9f:8a:86:49

Digest Algorithm

sha256

PE Digest Matches

true

f3:00:b9:a0:80:cd:e5:a6:32:99:f3:d5:85:19:ea:a6:5e:e7:76:3d:a4:c6:37:00:ef:de:ef:19:9f:8a:86:49
Signer

Actual PE Digest

f3:00:b9:a0:80:cd:e5:a6:32:99:f3:d5:85:19:ea:a6:5e:e7:76:3d:a4:c6:37:00:ef:de:ef:19:9f:8a:86:49

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\OneDLP\NxDes\Src\Release\NxdDs2.pdb

Imports

fltmgr.sys

FltAllocateContext
FltSetInstanceContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetStreamContext
FltGetStreamHandleContext
FltReferenceContext
FltReleaseContext
FltSetCallbackDataDirty
FltQueryVolumeInformationFile
FltCancelFileOpen
FltFindExtraCreateParameter
FltReleaseFileNameInformation
FltParseFileNameInformation
FltCreateFile
FltClose
FltGetUpperInstance
FltObjectDereference
FltAllocateExtraCreateParameterList
FltRemoveExtraCreateParameter
FltFreeExtraCreateParameterList
FltFreeExtraCreateParameter
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltDetachVolume
FltGetDeviceObject
FltQueryInformationFile
FltFsControlFile
FltSetInformationFile
FltAllocateCallbackData
FltFreeCallbackData
FltPerformSynchronousIo
FltAllocateCallbackDataEx
FltReuseCallbackData
FltQueryVolumeInformation
FltReadFile
FltWriteFile
FltGetFileNameInformationUnsafe
FltAllocateExtraCreateParameter
FltGetEcpListFromCallbackData
FltSetEcpListIntoCallbackData
FltGetRoutineAddress
FltCreateFileEx2
FltOplockFsctrl
FltCheckOplock

ntoskrnl.exe

PsGetCurrentThreadId
FsRtlIsPagingFile
memset
DbgPrint
ExRaiseStatus
ExIsResourceAcquiredExclusiveLite
memcpy
KeGetCurrentThread
KeInitializeEvent
KeSetEvent
KeWaitForSingleObject
ProbeForWrite
MmProbeAndLockPages
ExFreePoolWithTag
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
ObfDereferenceObject
ZwClose
SeTokenType
SeCreateClientSecurity
SeImpersonateClientEx
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
PsRevertToSelf
ObOpenObjectByPointer
FsRtlInsertExtraCreateParameter
IoFileObjectType
SeSinglePrivilegeCheck
SeExports
RtlInitUnicodeString
RtlGetVersion
MmGetSystemRoutineAddress
IoWMIRegistrationControl
RtlEqualUnicodeString
KeDelayExecutionThread
KeAreAllApcsDisabled
IoGetCurrentProcess
ExAcquireResourceExclusiveLite
ExSetResourceOwnerPointer
ExIsResourceAcquiredSharedLite
KeExpandKernelStackAndCalloutEx
ExAcquireSharedStarveExclusive
RtlCompareMemory
_aullrem
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
IoAllocateIrp
IofCallDriver
IoFreeIrp
ObReferenceObjectByHandle
ZwCreateFile
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeAreApcsDisabled
ExReleaseResourceForThreadLite
MmIsDriverVerifying
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
FsRtlAllocateExtraCreateParameter
FsRtlIsEcpFromUserMode
FsRtlAreVolumeStartupApplicationsComplete
FsRtlIsNtstatusExpected
RtlQueryRegistryValues
RtlIsNtDdiVersionAvailable
IoGetTransactionParameterBlock
ExAcquireResourceSharedLite
ExReleaseResourceLite
ObfReferenceObject
IoGetLowerDeviceObject
IoGetDeviceAttachmentBaseRef
KeBugCheckEx
ExAllocatePoolWithTag
RtlUnwind
MmUnlockPages

hal

KeGetCurrentIrql

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/drivers/ntdes/x86/nxddt2.cat
plugins/nxd/la/drivers/ntdes/x86/nxddt2.inf
plugins/nxd/la/drivers/ntdes/x86/nxddt2.sys
.sys windows:10 windows x86 arch:x86

a29db00eb8e37eef263da8ff410c4485

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

55:e2:94:41:9f:2b:5d:10:12:fd:13:1d:a3:f6:26:b9:c6:4e:8b:64:67:2c:53:75:26:2a:15:65:30:b0:87:69
Signer

Actual PE Digest

55:e2:94:41:9f:2b:5d:10:12:fd:13:1d:a3:f6:26:b9:c6:4e:8b:64:67:2c:53:75:26:2a:15:65:30:b0:87:69

Digest Algorithm

sha256

PE Digest Matches

true

55:e2:94:41:9f:2b:5d:10:12:fd:13:1d:a3:f6:26:b9:c6:4e:8b:64:67:2c:53:75:26:2a:15:65:30:b0:87:69
Signer

Actual PE Digest

55:e2:94:41:9f:2b:5d:10:12:fd:13:1d:a3:f6:26:b9:c6:4e:8b:64:67:2c:53:75:26:2a:15:65:30:b0:87:69

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\OneDLP\NxDes\Src\Release\NxdDt2.pdb

Imports

cng.sys

BCryptFinishHash
BCryptHashData
BCryptCreateHash
BCryptDestroyKey
BCryptDecrypt
BCryptEncrypt
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGetProperty
BCryptDestroyHash
BCryptOpenAlgorithmProvider

fltmgr.sys

FltInsertExtraCreateParameter
FltIsVolumeSnapshot
FltGetDestinationFileNameInformation
FltPerformSynchronousIo
FltFreeCallbackData
FltCheckOplock
FltOplockFsctrl
FltGetRoutineAddress
FltSetEcpListIntoCallbackData
FltGetVolumeGuidName
FltGetFileNameInformationUnsafe
FltGetVolumeFromInstance
FltAllocateCallbackData
FltAllocateContext
FltSetInstanceContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetStreamContext
FltGetStreamHandleContext
FltReferenceContext
FltReleaseContext
FltSetCallbackDataDirty
FltGetFileNameInformation
FltReleaseFileNameInformation
FltParseFileNameInformation
FltCreateFileEx2
FltWriteFile
FltSetInformationFile
FltQueryVolumeInformationFile
FltFlushBuffers
FltFsControlFile
FltReissueSynchronousIo
FltClose
FltCancelFileOpen
FltAllocateExtraCreateParameterList
FltAllocateExtraCreateParameter
FltGetUpperInstance
FltFindExtraCreateParameter
FltRemoveExtraCreateParameter
FltFreeExtraCreateParameterList
FltFreeExtraCreateParameter
FltGetEcpListFromCallbackData
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltAttachVolume
FltDetachVolume
FltGetFilterFromName
FltGetVolumeInstanceFromName
FltGetDiskDeviceObject
FltGetInstanceInformation
FltObjectDereference
FltLoadFilter
FltQueryInformationFile
FltGetRequestorProcess

ntoskrnl.exe

PsLookupThreadByThreadId
PsGetThreadProcess
memset
KeReadStateEvent
KeSetEvent
KeWaitForSingleObject
ExIsResourceAcquiredExclusiveLite
IofCompleteRequest
IoCsqInsertIrp
IoCsqRemoveNextIrp
FsRtlCancellableWaitForSingleObject
memcpy
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
PsSetCreateProcessNotifyRoutineEx
KeInitializeEvent
KeClearEvent
IoAllocateErrorLogEntry
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoWriteErrorLogEntry
IoCsqInitialize
PsGetCurrentProcessId
PsGetThreadProcessId
InitSafeBootMode
PsGetThreadId
DbgPrint
FsRtlIsPagingFile
RtlEqualUnicodeString
RtlIsNtDdiVersionAvailable
KeAreAllApcsDisabled
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExSetResourceOwnerPointerEx
IoGetCurrentProcess
ZwClose
ZwCreateSection
FsRtlFreeExtraCreateParameter
FsRtlInsertExtraCreateParameter
FsRtlFindExtraCreateParameter
FsRtlRemoveExtraCreateParameter
PsInitialSystemProcess
RtlCompareMemory
MmMapLockedPagesSpecifyCache
ZwCreateKey
ZwOpenKey
ZwEnumerateValueKey
ZwQueryValueKey
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
SeSinglePrivilegeCheck
SeExports
RtlInitUnicodeString
RtlGetVersion
MmGetSystemRoutineAddress
SeCaptureSubjectContext
SeReleaseSubjectContext
IoWMIRegistrationControl
ExUuidCreate
FsRtlGetNextExtraCreateParameter
MmProbeAndLockPages
MmBuildMdlForNonPagedPool
IoAllocateMdl
IoFreeMdl
RtlUpcaseUnicodeChar
TmGetTransactionId
ObQueryNameString
_stricmp
RtlUpperChar
RtlPrefixUnicodeString
IoVolumeDeviceToDosName
FsRtlAreNamesEqual
PsGetProcessImageFileName
KeGetCurrentThread
IoAllocateIrp
IofCallDriver
IoFreeIrp
ObReferenceObjectByHandle
ZwCreateFile
IoFileObjectType
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeAreApcsDisabled
ExReleaseResourceForThreadLite
MmIsDriverVerifying
FsRtlIsNameInExpression
KdDebuggerNotPresent
KdDebuggerEnabled
RtlQueryRegistryValues
RtlGUIDFromString
FsRtlAllocateExtraCreateParameter
FsRtlIsEcpFromUserMode
FsRtlAreVolumeStartupApplicationsComplete
memmove
IoGetTransactionParameterBlock
FsRtlIsNtstatusExpected
KeBugCheckEx
RtlSetDaclSecurityDescriptor
RtlUnwind
ObfDereferenceObject
ExIsResourceAcquiredSharedLite
ExFreePoolWithTag
ExAllocatePoolWithTag
PsGetCurrentThreadId
RtlFreeUnicodeString
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
ObOpenObjectByPointer
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
ZwSetValueKey

hal

KfAcquireSpinLock
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
KfReleaseSpinLock
KeGetCurrentIrql

Sections

.text
Size: 116KB - Virtual size: 115KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/drivers/ntdes/x86/nxdisolate.cat
plugins/nxd/la/drivers/ntdes/x86/nxdisolate.inf
plugins/nxd/la/drivers/ntdes/x86/nxdisolate.sys
.sys windows:10 windows x86 arch:x86

5f69159c4d7f354a1e3ed5509cda720d

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:b3:51:e4:72:d7:1f:ba:0e:60:ec:bd:1b:44:70:5f:7f:92:7f:5c:74:fe:45:7c:ba:37:5c:7e:af:33:f9:75
Signer

Actual PE Digest

5f:b3:51:e4:72:d7:1f:ba:0e:60:ec:bd:1b:44:70:5f:7f:92:7f:5c:74:fe:45:7c:ba:37:5c:7e:af:33:f9:75

Digest Algorithm

sha256

PE Digest Matches

true

5f:b3:51:e4:72:d7:1f:ba:0e:60:ec:bd:1b:44:70:5f:7f:92:7f:5c:74:fe:45:7c:ba:37:5c:7e:af:33:f9:75
Signer

Actual PE Digest

5f:b3:51:e4:72:d7:1f:ba:0e:60:ec:bd:1b:44:70:5f:7f:92:7f:5c:74:fe:45:7c:ba:37:5c:7e:af:33:f9:75

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\OneDLP\NxDes\Src\Release\NxdIsolate.pdb

Imports

fltmgr.sys

FltSetCallbackDataDirty
FltReleaseContext
FltQueryInformationFile
FltSetInformationFile
FltClose
FltDetachVolume
FltAllocateContext
FltSetInstanceContext
FltSetFileContext
FltSetStreamContext
FltSetStreamHandleContext
FltGetInstanceContext
FltGetFileContext
FltGetStreamContext
FltGetStreamHandleContext
FltFreeFileLock
FltParseFileNameInformation
FltCreateFileEx
FltFsControlFile
FltCancelFileOpen
FltOplockFsctrl
FltFindExtraCreateParameter
FltAllocateExtraCreateParameterList
FltRemoveExtraCreateParameter
FltGetNextExtraCreateParameter
FltReleaseFileNameInformation
FltFreeExtraCreateParameterList
FltGetEcpListFromCallbackData
FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltGetVolumeName
FltGetDeviceObject
FltGetDiskDeviceObject
FltIsVolumeWritable
FltIsVolumeSnapshot
FltQueryVolumeInformation
FltCompletePendedPreOperation
FltIsIoCanceled
FltCompletePendedPostOperation
FltAllocateCallbackData
FltFreeCallbackData
FltReuseCallbackData
FltPerformSynchronousIo
FltAllocateFileLock
FltProcessFileLock
FltGetRequestorProcess
FltCheckAndGrowNameControl
FltGetFileNameInformation
FltGetFileNameInformationUnsafe
FltQueryDirectoryFile
FltCheckOplock
FltOplockIsFastIoPossible
FltOplockBreakH
FltOplockIsSharedRequest
FltReissueSynchronousIo
FltCheckLockForReadAccess
FltIsOperationSynchronous
FltGetDestinationFileNameInformation
FltWriteFile
FltGetVolumeFromInstance
FltGetTopInstance
FltObjectDereference
FltCheckLockForWriteAccess
FltGetRoutineAddress
FltCreateFileEx2

ntoskrnl.exe

KeWaitForSingleObject
ExAcquireSharedStarveExclusive
ExReleaseResourceLite
ExIsResourceAcquiredExclusiveLite
ExIsResourceAcquiredSharedLite
MmGetSystemRoutineAddress
IoGetStackLimits
ObfReferenceObject
ObfDereferenceObject
ObDereferenceObjectDeferDelete
PsGetCurrentThreadId
PsIsSystemThread
MmCanFileBeTruncated
FsRtlIsNtstatusExpected
FsRtlChangeBackingFileObject
CcInitializeCacheMap
CcUninitializeCacheMap
CcPurgeCacheSection
CcFlushCache
CcGetFileObjectFromSectionPtrsRef
CcSetReadAheadGranularity
CcSetAdditionalCacheAttributes
memset
RtlFreeUnicodeString
RtlStringFromGUID
KeQuerySystemTime
ExAllocatePoolWithTag
ExFreePoolWithTag
ExGetPreviousMode
KeDelayExecutionThread
CcSetFileSizes
memcpy
ExInitializeResourceLite
ExDeleteResourceLite
FsRtlUninitializeOplock
FsRtlTeardownPerFileContexts
FsRtlTeardownPerStreamContexts
RtlEqualUnicodeString
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
KeClearEvent
MmDoesFileHaveUserWritableReferences
KeExpandKernelStackAndCalloutEx
IoIsFileObjectIgnoringSharing
FsRtlCurrentBatchOplock
FsRtlInsertExtraCreateParameter
SeTokenType
PsDereferencePrimaryToken
PsDereferenceImpersonationToken
FsRtlDissectName
IoGetCurrentProcess
ObReferenceObjectByHandle
SeSinglePrivilegeCheck
NtClose
KeStackAttachProcess
KeUnstackDetachProcess
IoAcquireVpbSpinLock
IoReleaseVpbSpinLock
ObOpenObjectByPointer
IoFileObjectType
SeExports
RtlInitUnicodeString
RtlGetVersion
IoWMIRegistrationControl
PsGetCurrentProcessId
FsRtlGetNextFileLock
FsRtlFastUnlockSingle
FsRtlFastUnlockAll
FsRtlFastUnlockAllByKey
FsRtlPrivateLock
KeAreApcsDisabled
KeAreAllApcsDisabled
MmFlushImageSection
CcZeroData
MmForceSectionClosed
ExRaiseStatus
IoGetTopLevelIrp
SeCreateClientSecurity
SeImpersonateClientEx
PsRevertToSelf
FsRtlInitializeOplock
FsRtlOplockKeysEqual
FsRtlIsPagingFile
MmMapLockedPagesSpecifyCache
FsRtlMdlReadCompleteDev
CcCopyRead
CcMdlRead
FsRtlCurrentOplockH
RtlCompareMemory
CcSetFileSizesEx
ExReleaseResourceForThreadLite
MmProbeAndLockPages
IoAllocateMdl
IoFreeMdl
PsGetThreadProcessId
FsRtlMdlWriteCompleteDev
FsRtlFastCheckLockForRead
FsRtlFastCheckLockForWrite
CcCanIWrite
CcDeferWrite
CcCopyWrite
CcPrepareMdlWrite
IoAllocateIrp
IofCallDriver
IoFreeIrp
ZwCreateFile
ZwClose
DbgPrint
KeEnterCriticalRegion
KeLeaveCriticalRegion
MmIsDriverVerifying
FsRtlIsNameInExpression
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
IoGetLowerDeviceObject
IoGetDeviceAttachmentBaseRef
IoGetTransactionParameterBlock
RtlQueryRegistryValues
KeBugCheckEx
KeGetCurrentThread
RtlUnwind
KeSetEvent
KeReadStateEvent
KeInitializeEvent
RtlIsNtDdiVersionAvailable
ExUuidCreate

hal

KfAcquireSpinLock
KeGetCurrentIrql
ExReleaseFastMutex
ExAcquireFastMutex
KfReleaseSpinLock

Sections

.text
Size: 198KB - Virtual size: 198KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/drivers/ntdes/x86/nxdsupport.cat
plugins/nxd/la/drivers/ntdes/x86/nxdsupport.inf
plugins/nxd/la/drivers/ntdes/x86/nxdsupport.sys
.sys windows:10 windows x86 arch:x86

3b4f8fcffae4aa5d6e0cecf9b1224253

Code Sign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:57:ee:4d:65:9a:92:3e:7c:10:00:00:00:00:00:57
Certificate

Issuer

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/06/2022, 18:08

Not After

01/06/2023, 18:08

Subject

CN=Microsoft Windows Hardware Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

33:00:00:00:0d:69:0d:5d:78:93:d0:76:df:00:00:00:00:00:0d
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/10/2014, 20:31

Not After

15/10/2029, 20:41

Subject

CN=Microsoft Windows Third Party Component CA 2014,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c6:ae:15:3c:2c:78:56:2e:a4:f0:be:f7:35:a6:a0:dc:8d:ec:a5:e9:25:f0:83:91:c8:3f:30:bd:39:9f:2b:2e
Signer

Actual PE Digest

c6:ae:15:3c:2c:78:56:2e:a4:f0:be:f7:35:a6:a0:dc:8d:ec:a5:e9:25:f0:83:91:c8:3f:30:bd:39:9f:2b:2e

Digest Algorithm

sha256

PE Digest Matches

true

c6:ae:15:3c:2c:78:56:2e:a4:f0:be:f7:35:a6:a0:dc:8d:ec:a5:e9:25:f0:83:91:c8:3f:30:bd:39:9f:2b:2e
Signer

Actual PE Digest

c6:ae:15:3c:2c:78:56:2e:a4:f0:be:f7:35:a6:a0:dc:8d:ec:a5:e9:25:f0:83:91:c8:3f:30:bd:39:9f:2b:2e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\OneDLP\NxDes\Src\Release\NxdSupport.pdb

Imports

fltmgr.sys

FltRegisterFilter
FltUnregisterFilter
FltStartFiltering
FltReleaseFileNameInformation
FltGetVolumeName
FltCreateFileEx
FltClose
FltIsVolumeSnapshot
FltObjectReference
FltObjectDereference
FltAllocateCallbackData
FltFreeCallbackData
FltReuseCallbackData
FltPerformSynchronousIo
FltReadFile
FltGetRoutineAddress
FltOplockFsctrl
FltCheckOplock
FltGetFileNameInformationUnsafe
FltGetVolumeGuidName

ntoskrnl.exe

ExAcquireSharedStarveExclusive
ExReleaseResourceLite
ExConvertExclusiveToSharedLite
ExDeleteResourceLite
memset
KeGetCurrentThread
KeDelayExecutionThread
KeAreApcsDisabled
ExAllocatePoolWithTag
ExFreePoolWithTag
PsGetCurrentThreadId
RtlInitUnicodeString
RtlWriteRegistryValue
RtlUnicodeStringToAnsiString
RtlEqualUnicodeString
RtlFreeUnicodeString
RtlStringFromGUID
RtlGetVersion
MmGetSystemRoutineAddress
IoWMIRegistrationControl
ExUuidCreate
memcpy
KeInitializeEvent
KeClearEvent
KeReadStateEvent
KeSetEvent
KeSetPriorityThread
KeWaitForSingleObject
KeQuerySystemTime
KeQueryActiveProcessorCount
ExAcquireSpinLockShared
ExReleaseSpinLockShared
ExAcquireSpinLockExclusiveAtDpcLevel
ExAcquireSpinLockExclusive
ExReleaseSpinLockExclusiveFromDpcLevel
ExReleaseSpinLockExclusive
PsCreateSystemThread
PsTerminateSystemThread
ZwClose
KeInitializeQueue
KeInsertQueue
KeRemoveQueue
KeRundownQueue
ZwWaitForSingleObject
_alldiv
_aulldiv
RtlCopyUnicodeString
PsSetCreateThreadNotifyRoutine
PsRemoveCreateThreadNotifyRoutine
ObOpenObjectByPointer
PsProcessType
RtlIntegerToUnicodeString
ExAcquireResourceExclusiveLite
IoAllocateErrorLogEntry
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoWriteErrorLogEntry
ObfDereferenceObject
ObDereferenceObjectDeferDelete
PsSetCreateProcessNotifyRoutineEx
PsGetThreadProcessId
ZwOpenProcess
RtlValidSid
RtlEqualSid
RtlLengthRequiredSid
RtlConvertSidToUnicodeString
PsLookupProcessByProcessId
PsLookupThreadByThreadId
ZwOpenProcessTokenEx
ZwOpenThreadTokenEx
ZwQueryInformationToken
PsGetProcessExitProcessCalled
ZwOpenThread
PsInitialSystemProcess
ExIsResourceAcquiredExclusiveLite
RtlPrefixUnicodeString
memmove
KeWaitForMultipleObjects
KeBugCheckEx
CcWaitForCurrentLazyWriterActivity
_allmul
MmBuildMdlForNonPagedPool
MmMapLockedPagesSpecifyCache
MmUnmapLockedPages
MmIsDriverVerifying
FsRtlCancellableWaitForSingleObject
KdDebuggerNotPresent
KdDebuggerEnabled
RtlQueryRegistryValues
RtlIsNtDdiVersionAvailable
FsRtlIsNtstatusExpected
RtlGUIDFromString
FsRtlAreVolumeStartupApplicationsComplete
DbgPrint
RtlUnwind
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeExports
RtlCreateSecurityDescriptor
_wcsnicmp
wcschr
RtlAbsoluteToSelfRelativeSD
RtlAddAccessAllowedAce
RtlLengthSid
IoIsWdmVersionAvailable
RtlSetDaclSecurityDescriptor
ZwOpenKey
ZwSetValueKey
ZwQueryValueKey
ZwCreateKey
ExAcquireResourceSharedLite
ExInitializeResourceLite
KeLeaveCriticalRegion
KeEnterCriticalRegion
RtlAppendUnicodeStringToString

hal

KfAcquireSpinLock
KeReleaseInStackQueuedSpinLock
KeAcquireInStackQueuedSpinLock
KeGetCurrentIrql
KfReleaseSpinLock

Sections

.text
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

PAGE
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

INIT
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/x64/NtDesUtil.dll
.dll regsvr32 windows:6 windows x64 arch:x64

e2002e1933e22eea8e5de28d0f339b8f

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ab:17:eb:c8:cc:29:c0:01:29:e4:9b:3f:86:3b:9f:d2:dc:45:cb:f5:f4:88:1f:58:f0:03:67:b4:4f:96:73:80
Signer

Actual PE Digest

ab:17:eb:c8:cc:29:c0:01:29:e4:9b:3f:86:3b:9f:d2:dc:45:cb:f5:f4:88:1f:58:f0:03:67:b4:4f:96:73:80

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\UM_FESF\x64\Release\NtDesUtil.pdb

Imports

ntdll

NtCreateFile
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlPcToFileHeader

kernel32

EncodePointer
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
lstrcmpiW
MultiByteToWideChar
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
GetVolumePathNamesForVolumeNameW
CloseHandle
DeviceIoControl
WaitForSingleObject
OpenEventW
FindResourceExW
LockResource
LocalFree
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetStringTypeW
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
WriteConsoleW
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
GetStdHandle
GetModuleHandleExW
LCMapStringW
IsDebuggerPresent
OutputDebugStringW
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess

user32

CharNextW

advapi32

ConvertStringSidToSidW
RegQueryValueExW
GetLengthSid
CopySid
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

ole32

CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoCreateFreeThreadedMarshaler

oleaut32

SafeArrayGetVartype
SafeArrayCopy
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayDestroy
SafeArrayCreate
SysAllocStringByteLen
SysStringByteLen
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
VariantClear
SysAllocString
SafeArrayGetUBound

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/x64/NtDeshs.exe
.exe windows:5 windows x64 arch:x64

67d523964102b510924e8d91d4e67579

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

85:4d:a3:8b:33:48:d0:8d:d5:84:c1:df:51:a7:26:31:70:91:39:de:f9:ff:b3:2c:ac:10:e4:9a:61:8f:22:ef
Signer

Actual PE Digest

85:4d:a3:8b:33:48:d0:8d:d5:84:c1:df:51:a7:26:31:70:91:39:de:f9:ff:b3:2c:ac:10:e4:9a:61:8f:22:ef

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\Release\Client\x64\NtDeshs.pdb

Imports

kernel32

MoveFileExW
CopyFileExW
GetFileAttributesW
SetFileAttributesW
GetTickCount
SetLastError
GetCommandLineW
CreateEventW
Sleep
SetEvent
GetCurrentThreadId
CreateThread
GetCurrentProcess
DeleteFileW
CreateMutexW
CloseHandle
WaitForSingleObject
ReleaseMutex
GetCurrentThread
LocalFree
MultiByteToWideChar
FindResourceW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
lstrcmpiW
SizeofResource
LoadResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
WriteConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
VirtualQuery
VirtualProtect
VirtualAlloc
GetSystemInfo
RtlUnwindEx
RtlPcToFileHeader
GetLastError
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetProcAddress
FreeLibrary
DecodePointer
OpenProcess
CreateFileW
FindClose
WideCharToMultiByte
EncodePointer
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
OutputDebugStringW
GetModuleFileNameA
GetFileSizeEx
WriteFile
OutputDebugStringA
CreateFileA
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
SetFilePointerEx
FindNextFileW

user32

TranslateMessage
DispatchMessageW
CharUpperW
MessageBoxW
GetMessageW
CharNextW
LoadStringW
PostThreadMessageW
wsprintfA

advapi32

AddAce
CopySid
GetLengthSid
GetSidSubAuthority
InitializeSid
AllocateAndInitializeSid
GetSidLengthRequired
EqualSid
IsValidSid
GetTokenInformation
SetThreadToken
RevertToSelf
ConvertSidToStringSidW
CheckTokenMembership
MakeSelfRelativeSD
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
GetSecurityDescriptorLength
GetAce
DuplicateToken
GetAclInformation
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
ImpersonateSelf
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
OpenProcessToken
RegQueryValueExW
CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW
InitializeAcl

ole32

StringFromGUID2
CoCreateInstance
CoInitializeSecurity
CoReleaseServerProcess
CoAddRefServerProcess
CoResumeClassObjects
CoRevokeClassObject
CoRegisterClassObject
CoInitializeEx
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoImpersonateClient
CoRevertToSelf

oleaut32

SysAllocString
SysFreeString
SysStringLen
VarUI4FromStr
LoadTypeLi
LoadRegTypeLi
RegisterTypeLi
UnRegisterTypeLi
SafeArrayCreate
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetLBound
SafeArrayLock
SafeArrayUnlock
SafeArrayCopy
SafeArrayGetVartype
VariantInit
VariantClear

shlwapi

PathFileExistsW
PathIsNetworkPathW
wvnsprintfA
SHSetValueA
PathFindFileNameA
wnsprintfW
wnsprintfA

userenv

UnloadUserProfile

shell32

SHCreateDirectoryExA

Sections

.text
Size: 296KB - Virtual size: 295KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/x64/NtDeshs2.dll
.dll windows:5 windows x64 arch:x64

6f571a8e244f490e980b10a3c9552411

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

16:a8:66:b2:6b:a4:1b:d5:39:c9:d2:a4:0d:0a:38:88:53:bf:59:14:e5:29:23:0a:52:d4:ab:f3:bf:74:af:c5
Signer

Actual PE Digest

16:a8:66:b2:6b:a4:1b:d5:39:c9:d2:a4:0d:0a:38:88:53:bf:59:14:e5:29:23:0a:52:d4:ab:f3:bf:74:af:c5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\x64\NtDeshs2.pdb

Imports

kernel32

HeapFree
InitializeCriticalSectionAndSpinCount
HeapSize
GetLastError
DisableThreadLibraryCalls
HeapReAlloc
RaiseException
HeapAlloc
DeleteCriticalSection
GetProcessHeap
CreateFileW
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WriteFile
SetStdHandle
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
LocalFree
CloseHandle
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType
GetStringTypeW

ole32

CoCreateInstance
CoUninitialize
CoInitialize

oleaut32

SysFreeString
SysAllocString

Exports

Exports

DesUtilIsEncryptedFile

Sections

.text
Size: 49KB - Virtual size: 49KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/x64/WinNtDes.dll
.dll windows:5 windows x64 arch:x64

de1329fee8d4cbd72b9cff9096130539

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b5:f4:ea:0e:56:51:db:04:82:ea:6c:6a:3a:98:94:85:79:a1:f8:7c:35:af:d6:ee:f9:fd:ec:e2:e4:2a:87:2b
Signer

Actual PE Digest

b5:f4:ea:0e:56:51:db:04:82:ea:6c:6a:3a:98:94:85:79:a1:f8:7c:35:af:d6:ee:f9:fd:ec:e2:e4:2a:87:2b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\x64\WinNtDes.pdb

Imports

kernel32

GetSystemDirectoryW
SleepEx
GetWindowsDirectoryW
QueueUserAPC
WaitForSingleObjectEx
TerminateThread
CreateEventW
OpenProcess
OpenEventW
WaitForSingleObject
GetModuleFileNameW
GetTickCount
DisableThreadLibraryCalls
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
Sleep
QueueUserWorkItem
OpenThread
CloseHandle
GetProcessIdOfThread
DeleteCriticalSection
HeapDestroy
SystemTimeToTzSpecificLocalTime
DecodePointer
HeapAlloc
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
GetProcessHeap
RtlUnwind
MoveFileExW
CreateDirectoryW
SetStdHandle
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
RaiseException
HeapReAlloc
GetLastError
HeapSize
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
SetConsoleCtrlHandler
WriteConsoleW
GetFileType
GetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
ExitProcess
InterlockedFlushSList
RtlPcToFileHeader
RtlUnwindEx
ReleaseMutex
InitializeCriticalSectionAndSpinCount
HeapFree
FormatMessageW
WideCharToMultiByte
SetLastError
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
OutputDebugStringW
LocalFree
GetModuleFileNameA
GetFileSizeEx
WriteFile
OutputDebugStringA
CreateFileA
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
SetFilePointerEx
ReadFile
QueryDosDeviceW
GetLogicalDrives
FindFirstFileW
FindNextFileW
lstrcpynW
DeviceIoControl
GetDriveTypeA
SetFilePointer
SetEndOfFile
GetTempPathW
FindClose
GetVolumeInformationA
LocalAlloc
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
GetModuleHandleA
SetFileAttributesW
GetFileAttributesExW
FileTimeToSystemTime
DeleteFileA
DeleteFileW
LoadLibraryW
FreeLibrary
CreateFileMappingW
MapViewOfFile
LoadLibraryExW
lstrlenW
GetFileSize
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
CreateMutexW
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
LoadLibraryA
GetVersionExA
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
WritePrivateProfileStringA
GetComputerNameW
CreateDirectoryA
GetPrivateProfileStringA
GetDriveTypeW
OpenFileMappingW
OpenMutexW
GetCurrentDirectoryW

user32

GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
CharUpperW
wsprintfA

ole32

CoCreateInstance
CoInitializeEx

oleaut32

SafeArrayUnlock
SysFreeString
VariantClear
SysStringLen
SysAllocStringLen
VariantInit
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayGetLBound
SafeArrayGetVartype
SysAllocString
SafeArrayLock

shlwapi

SHSetValueA
PathAppendA
PathFileExistsA
PathFindFileNameA
SHDeleteValueA
wvnsprintfA
PathAppendW
SHSetValueW
StrToIntExA
PathFindFileNameW
wnsprintfW
PathMatchSpecW
PathFileExistsW
wnsprintfA

winntdes.exe

FePolSetConfiguration

ws2_32

WSAIoctl
shutdown
WSACleanup
WSAStartup
WSAGetLastError
setsockopt
htons
recv
connect
socket
inet_addr
WSASetLastError
WSACreateEvent
getnameinfo
ioctlsocket
sendto
WSACloseEvent
closesocket
bind
gethostname
inet_ntoa
gethostbyname
recvfrom
freeaddrinfo
ntohs
getaddrinfo
getsockopt
listen
htonl
accept
select
send
WSAEnumNetworkEvents
WSAEventSelect
getpeername
getsockname
__WSAFDIsSet

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW

crypt32

CryptMsgClose
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertDuplicateCertificateContext
CertGetNameStringW
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFindCertificateInStore

wintrust

CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminReleaseCatalogContext
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext
CryptCATCatalogInfoFromContext
WinVerifyTrust

netapi32

Netbios

rpcrt4

UuidFromStringA

iphlpapi

GetAdaptersAddresses

wldap32

ord41
ord117
ord26
ord27
ord127
ord167
ord142
ord216
ord14
ord219
ord79
ord133
ord147
ord301
ord145
ord208
ord46

advapi32

RegOpenKeyExA
OpenProcessToken
RegSetValueExW
GetTokenInformation
RegCreateKeyExW
SetEntriesInAclW
AllocateAndInitializeSid
RegQueryValueExA
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExW
InitializeSecurityDescriptor
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupPrivilegeValueW
SetSecurityDescriptorDacl
AdjustTokenPrivileges
RegCloseKey
SetFileSecurityW

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExA
SHCreateDirectoryExW

Exports

Exports

PolicyDllInit
PurgePolicyCacheFile

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 799KB - Virtual size: 799KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/x64/WinNtDes.exe
.exe windows:6 windows x64 arch:x64

db3bf33d971d6c3b08fd05b4dd321cb6

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7d:05:b4:8c:43:05:79:83:1e:0f:68:2b:8e:1a:4d:e8:77:3f:8b:1b:ba:1c:1e:2b:42:2d:0f:e0:36:ab:01:74
Signer

Actual PE Digest

7d:05:b4:8c:43:05:79:83:1e:0f:68:2b:8e:1a:4d:e8:77:3f:8b:1b:ba:1c:1e:2b:42:2d:0f:e0:36:ab:01:74

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\UM_FESF\x64\Release\WinNtDes.pdb

Imports

kernel32

GetProcAddress
LocalFree
FreeLibrary
SetConsoleCtrlHandler
DebugBreak
GetOverlappedResult
lstrlenW
GetModuleFileNameW
FormatMessageW
GetTimeFormatW
GetDateFormatW
WriteConsoleW
ResetEvent
CreateThread
LoadLibraryW
CloseHandle
SetEvent
GetLastError
CreateEventW
ReleaseMutex
CreateFileW
LocalAlloc
WaitForSingleObject
CreateMutexW
WaitForMultipleObjects
DeviceIoControl
SetLastError
FlushFileBuffers
CancelIo
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetFileType
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
GetFileSizeEx
SetFilePointerEx
GetConsoleOutputCP
GetConsoleMode
HeapSize
ReadFile
ReadConsoleW
SetEndOfFile

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW
RegSetValueExW
RegDeleteValueW
SetSecurityDescriptorDacl
RegCloseKey
AllocateAndInitializeSid
SetEntriesInAclW
RegCreateKeyExW
FreeSid
InitializeSecurityDescriptor
RegQueryValueExW

Exports

Exports

FePolSetConfiguration

Sections

.text
Size: 185KB - Virtual size: 185KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/nxd/la/x64/WinNtDs.exe
.exe windows:6 windows x64 arch:x64

c955909685ae7875ba931a7d50cc2a09

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1a:e4:e1:f7:9c:62:21:ec:d3:fc:75:e1:46:7a:b4:75:ce:33:41:3e:6c:0d:23:6d:dc:03:b3:d2:34:5a:65:6f
Signer

Actual PE Digest

1a:e4:e1:f7:9c:62:21:ec:d3:fc:75:e1:46:7a:b4:75:ce:33:41:3e:6c:0d:23:6d:dc:03:b3:d2:34:5a:65:6f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\UM_FESF\x64\Release\WinNtDs.pdb

Imports

ntdll

NtSetEaFile
NtQueryEaFile
RtlNtStatusToDosError
NtQueryInformationFile
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlPcToFileHeader
RtlUnwindEx
RtlCaptureContext
NtCreateFile

kernel32

FlushFileBuffers
GetFileSizeEx
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
DeviceIoControl
LCMapStringW
GetFileType
GetStdHandle
GetModuleHandleExW
ExitProcess
CreateThread
Sleep
CreateEventW
WaitForSingleObject
SetEvent
DecodePointer
GetCommandLineW
MultiByteToWideChar
ReplaceFileW
lstrcmpiW
LocalFree
FindResourceW
SizeofResource
LockResource
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
FindResourceExW
GetCurrentThread
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
SetLastError
GetLastError
RaiseException
CloseHandle
SetFileTime
SetFileAttributesW
GetFileTime
GetFileAttributesW
DeleteFileW
CreateFileW
WriteConsoleW
VirtualQuery
VirtualProtect
VirtualAlloc
GetSystemInfo
TlsFree
GetCurrentThreadId
GetConsoleMode
GetConsoleOutputCP
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringW
IsDebuggerPresent

user32

CharNextW
LoadStringW
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
CharUpperW
MessageBoxW

advapi32

OpenSCManagerW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
OpenServiceW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
RegQueryValueExW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
SetNamedSecurityInfoW
GetNamedSecurityInfoW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
LookupPrivilegeValueW
RevertToSelf
MakeSelfRelativeSD
IsValidSid
InitializeSid
InitializeAcl
ImpersonateSelf
GetTokenInformation
GetSidSubAuthority
GetSidLengthRequired
GetSecurityDescriptorSacl
GetSecurityDescriptorOwner
GetSecurityDescriptorLength
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
GetLengthSid
GetAclInformation
GetAce
EqualSid
CopySid
AdjustTokenPrivileges
AddAce
OpenThreadToken
SetThreadToken

ole32

CoReleaseServerProcess
CoAddRefServerProcess
CoResumeClassObjects
CoRevokeClassObject
CoRegisterClassObject
CoInitializeEx
CoUninitialize
CoInitializeSecurity
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateGuid
StringFromGUID2
CoCreateInstance
CoRevertToSelf
CoImpersonateClient
CoCreateFreeThreadedMarshaler
CoTaskMemFree

oleaut32

SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
SysStringByteLen
SysAllocStringByteLen
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
VarBstrCat
VarUI4FromStr
VariantClear
SafeArrayGetVartype
SafeArrayCopy
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayCreate

userenv

UnloadUserProfile

Sections

.text
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/others/DebugX.exe
.exe windows:5 windows x86 arch:x86

56aa8e5e1946a192fa8339d0764deb2b

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

57:79:43:ad:98:91:b4:0d:b1:47:8e:3c:c1:6f:fc:b2:76:e1:31:09:de:e5:b4:0d:27:e3:36:f8:ff:19:c7:2e
Signer

Actual PE Digest

57:79:43:ad:98:91:b4:0d:b1:47:8e:3c:c1:6f:fc:b2:76:e1:31:09:de:e5:b4:0d:27:e3:36:f8:ff:19:c7:2e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\NSecsoft\NSec\NSEC-Common\tools\DebugX\Release\DebugX.pdb

Imports

kernel32

ReadConsoleW
GetConsoleMode
WriteConsoleW
GetStdHandle
ExitProcess
GetFileType
SetStdHandle
QueryPerformanceFrequency
HeapQueryInformation
VirtualQuery
GetTimeZoneInformation
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
RtlUnwind
lstrlenW
SetFilePointerEx
GetSystemDirectoryA
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
OpenProcess
DeviceIoControl
lstrcpynW
FindNextFileW
FindFirstFileW
QueryDosDeviceW
GetSystemTime
LockFileEx
CreateFileMappingA
HeapCompact
GetSystemInfo
DeleteFileW
FlushViewOfFile
GetFileAttributesExW
FormatMessageW
GetDateFormatW
UnmapViewOfFile
GetVersionExW
GetFileAttributesW
CreateFileW
GetTempPathW
UnlockFileEx
GetDiskFreeSpaceW
InterlockedCompareExchange
GetFullPathNameW
HeapCreate
TryEnterCriticalSection
AreFileApisANSI
ReleaseMutex
MapViewOfFile
CreateFileMappingW
CreateDirectoryA
GetComputerNameW
GetDriveTypeA
GetDriveTypeW
SetFileAttributesW
OpenMutexW
OutputDebugStringW
GetConsoleCP
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetConsoleCtrlHandler
CreateDirectoryW
MoveFileExW
SleepEx
CompareFileTime
GetEnvironmentVariableA
WaitForMultipleObjects
PeekNamedPipe
GetStringTypeW
CompareStringW
GetTimeFormatW
LCMapStringW
HeapValidate
VerifyVersionInfoW
SetConsoleMode
ReadConsoleA
GetEnvironmentVariableW
InterlockedExchangeAdd
GetVersion
DeleteFiber
SwitchToFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
GlobalMemoryStatus
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
GetTempFileNameA
GetDiskFreeSpaceA
SearchPathA
GetProfileIntA
GetTempPathA
VerifyVersionInfoA
VerSetConditionMask
FindResourceExW
GetTickCount
GetWindowsDirectoryA
SystemTimeToTzSpecificLocalTime
SetFileAttributesA
GetFileTime
GetFileSizeEx
GetFileAttributesExA
GetFileAttributesA
FileTimeToLocalFileTime
SetErrorMode
lstrcpyA
SystemTimeToFileTime
FileTimeToSystemTime
GetCPInfo
GetOEMCP
VirtualProtect
GetACP
GetThreadLocale
GetVolumeInformationA
lstrcmpiA
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetFullPathNameA
GetFileSize
FlushFileBuffers
FindFirstFileA
FindClose
CreateFileA
GlobalFlags
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetLocaleInfoW
GetCurrentDirectoryA
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
CopyFileA
FormatMessageA
LocalFree
GlobalSize
LeaveCriticalSection
EnterCriticalSection
MulDiv
GlobalGetAtomNameA
GlobalFindAtomA
lstrcmpW
LoadLibraryA
GetSystemDirectoryW
EncodePointer
FindResourceA
GlobalFree
GlobalUnlock
FreeResource
GlobalAddAtomA
WritePrivateProfileStringA
GetPrivateProfileStringA
GetPrivateProfileIntA
CompareStringA
WideCharToMultiByte
MultiByteToWideChar
lstrcmpA
GlobalDeleteAtom
GlobalLock
GlobalAlloc
FindResourceW
SizeofResource
LockResource
LoadResource
LoadLibraryExW
GetModuleHandleW
GetModuleHandleA
GetModuleFileNameW
GetModuleFileNameA
FreeLibrary
GetVersionExA
GetCurrentThread
SetLastError
OutputDebugStringA
ResumeThread
SetThreadPriority
GetCurrentThreadId
WaitForSingleObject
DeleteFileA
GetLogicalDrives
GetLocalTime
CreateThread
Sleep
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
GetProcAddress
HeapDestroy
DecodePointer
HeapAlloc
LoadLibraryW
RaiseException
CloseHandle
HeapReAlloc
GetLastError
HeapSize
CreateMutexW
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
VirtualAlloc
GetCurrentDirectoryW

user32

SetDlgItemTextW
DrawIcon
GetSystemMetrics
wsprintfA
GetMessageA
TranslateMessage
DispatchMessageA
PeekMessageA
IsWindowVisible
GetActiveWindow
GetKeyState
ValidateRect
GetCursorPos
SetWindowsHookExA
CallNextHookEx
PostMessageA
PostQuitMessage
ShowOwnedPopups
SetCursor
IsWindowEnabled
MessageBoxA
GetWindowLongA
GetParent
GetWindowThreadProcessId
GetLastActivePopup
IsWindow
DestroyWindow
CreateDialogIndirectParamA
EndDialog
GetDlgItem
GetNextDlgTabItem
SetActiveWindow
GetDesktopWindow
SetWindowPos
SetWindowContextHelpId
GetWindow
MapDialogRect
GetFocus
CheckMenuItem
EnableMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
SetMenuItemInfoA
LoadBitmapW
RegisterWindowMessageA
GetMessagePos
GetMessageTime
DefWindowProcA
CallWindowProcA
RegisterClassA
GetClassInfoA
GetClassInfoExA
CreateWindowExA
IsMenu
GetProcessWindowStation
GetUserObjectInformationW
CharUpperW
IsChild
GetWindowPlacement
SetDlgItemTextA
DrawFrameControl
IsZoomed
LoadMenuW
GetSystemMenu
SetCursorPos
CopyIcon
FrameRect
UnionRect
PostThreadMessageA
UpdateLayeredWindow
MonitorFromPoint
GetComboBoxInfo
GetKeyboardLayout
IsCharLowerA
MapVirtualKeyExA
GetKeyboardState
ToAsciiEx
LoadAcceleratorsW
CreateAcceleratorTableA
DestroyAcceleratorTable
SendMessageA
GetClientRect
IsIconic
UnregisterClassA
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuA
EnableWindow
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefFrameProcA
DefMDIChildProcA
TranslateMDISysAccel
SubtractRect
MessageBoxW
LoadIconW
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
GetDlgCtrlID
SetFocus
GetCapture
GetMenu
SetMenu
GetSubMenu
GetMenuItemID
GetMenuItemCount
TrackPopupMenu
UpdateWindow
GetForegroundWindow
SetForegroundWindow
BeginPaint
EndPaint
RedrawWindow
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
SetPropA
GetPropA
RemovePropA
GetWindowTextA
GetWindowTextLengthA
GetWindowRect
AdjustWindowRectEx
ScreenToClient
MapWindowPoints
GetSysColor
CopyRect
EqualRect
PtInRect
SetWindowLongA
GetClassLongA
GetClassNameA
GetTopWindow
UnhookWindowsHookEx
LoadIconA
SetScrollInfo
GetScrollInfo
WinHelpA
MonitorFromWindow
GetMonitorInfoA
ShowWindow
MoveWindow
CreateMenu
GetWindowRgn
DestroyCursor
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
SetParent
SetWindowRgn
SetClassLongA
EnumDisplayMonitors
SetLayeredWindowAttributes
GetKeyNameTextA
MapVirtualKeyA
NotifyWinEvent
InvertRect
HideCaret
EnableScrollBar
GetIconInfo
InsertMenuItemA
CheckDlgButton
SendDlgItemMessageA
SetWindowTextA
IsDialogMessageA
DrawTextA
DrawTextExA
DrawIconEx
GrayStringA
TabbedTextOutA
GetDC
GetWindowDC
ReleaseDC
ClientToScreen
FillRect
DrawFocusRect
RegisterClipboardFormatA
GetMenuDefaultItem
ReuseDDElParam
SetRectEmpty
OffsetRect
GetMenuStringA
GetMenuState
InsertMenuA
AppendMenuA
RemoveMenu
CopyImage
SystemParametersInfoA
DeleteMenu
RealChildWindowFromPoint
SetTimer
KillTimer
InvalidateRect
WaitMessage
SetCapture
ReleaseCapture
WindowFromPoint
LoadCursorA
LoadCursorW
GetSysColorBrush
DestroyIcon
CharUpperA
UnpackDDElParam
CharNextA
CopyAcceleratorTableA
InvalidateRgn
SetRect
IntersectRect
IsRectEmpty
GetNextDlgGroupItem
MessageBeep
DrawStateA
DrawEdge
CharUpperBuffA
DestroyMenu
GetMenuItemInfoA
InflateRect
GetAsyncKeyState
TrackMouseEvent
LoadImageW
BringWindowToTop
LoadAcceleratorsA
TranslateAcceleratorA
LoadMenuA
CreatePopupMenu
LoadImageA

gdi32

GetClipBox
ExcludeClipRect
Escape
DeleteObject
DeleteDC
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateCompatibleDC
BitBlt
GetObjectA
SetTextColor
SetBkColor
CreateBitmap
GetStockObject
PtInRegion
GetDeviceCaps
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetTextFaceA
GetObjectType
GetPixel
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectObject
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
MoveToEx
TextOutA
ExtTextOutA
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CopyMetaFileA
CreateDCA
CreateFontIndirectA
GetTextExtentPoint32A
GetTextMetricsA
GetBkColor
GetTextColor
CreateRectRgnIndirect
GetRgnBox
CombineRgn
GetMapMode
PatBlt
SetRectRgn
DPtoLP
CreateCompatibleBitmap
EnumFontFamiliesExA
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
CreateDIBitmap
EnumFontFamiliesA
GetTextCharsetInfo
SetPixel
StretchBlt
CreateDIBSection
SetDIBColorTable
CreateEllipticRgn
Ellipse
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
OffsetRgn
RoundRect
FillRgn
FrameRgn
ExtFloodFill
GetBoundsRect

msimg32

TransparentBlt
AlphaBlend

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

InitiateSystemShutdownExW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
RegEnumKeyExA
RegOpenKeyExW
RegEnumValueA
RegQueryValueA
RegEnumKeyA
RegSetValueExA
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
RegQueryValueExW
ConvertSidToStringSidW
RegSetValueExW
RegCreateKeyExW
SetFileSecurityW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CryptEnumProvidersW
CryptReleaseContext
CryptDestroyKey
OpenProcessToken

shell32

SHGetSpecialFolderLocation
SHGetDesktopFolder
ShellExecuteA
SHGetPathFromIDListA
SHBrowseForFolderA
SHAppBarMessage
DragFinish
DragQueryFileA
SHGetFileInfoA
SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHCreateDirectoryExA

comctl32

InitCommonControlsEx

shlwapi

PathRemoveFileSpecW
PathIsUNCA
PathStripToRootA
StrFormatKBSizeA
PathFindFileNameW
wvnsprintfA
SHSetValueA
PathAppendA
PathAppendW
PathFileExistsW
PathFindFileNameA
PathFindExtensionA
PathFileExistsA
SHDeleteValueW
SHSetValueW
SHGetValueW
wnsprintfW
wnsprintfA

uxtheme

GetThemeSysColor
CloseThemeData
DrawThemeBackground
GetThemeColor
OpenThemeData
IsThemeBackgroundPartiallyTransparent
DrawThemeParentBackground
IsAppThemed
GetWindowTheme
DrawThemeText
GetCurrentThemeName
GetThemePartSize

ole32

IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
CoRegisterMessageFilter
OleIsCurrentClipboard
OleFlushClipboard
CoRevokeClassObject
CreateStreamOnHGlobal
OleUninitialize
OleInitialize
CoFreeUnusedLibraries
CreateILockBytesOnHGlobal
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoGetClassObject
CoDisconnectObject
CoInitializeEx
ReleaseStgMedium
OleDuplicateData
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromProgID
CLSIDFromString
CoInitialize
CoCreateInstance
CoCreateGuid
CoUninitialize
DoDragDrop

oleaut32

VarBstrFromDate
LoadTypeLi
VariantCopy
SafeArrayDestroy
VariantTimeToSystemTime
SystemTimeToVariantTime
SysStringLen
SysAllocString
OleCreateFontIndirect
SysAllocStringByteLen
VariantChangeType
VariantClear
VariantInit
SysFreeString
SysAllocStringLen

oledlg

ord8

gdiplus

GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipCreateBitmapFromStream
GdipCloneImage
GdiplusStartup
GdipFree
GdipAlloc
GdiplusShutdown
GdipDisposeImage
GdipDrawImageRectI
GdipSetInterpolationMode
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipBitmapUnlockBits
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipGetImagePaletteSize

ws2_32

ntohs
getsockopt
getsockname
getpeername
WSAEventSelect
send
WSACleanup
__WSAFDIsSet
select
bind
accept
closesocket
WSACloseEvent
WSACreateEvent
WSASetLastError
inet_addr
socket
connect
recv
htons
setsockopt
WSAGetLastError
gethostbyname
inet_ntoa
gethostname
htonl
listen
getaddrinfo
recvfrom
sendto
ioctlsocket
getnameinfo
shutdown
WSAStartup
WSAIoctl
freeaddrinfo
WSAEnumNetworkEvents

oleacc

CreateStdAccessibleObject
LresultFromObject
AccessibleObjectFromWindow

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

winmm

PlaySoundA

iphlpapi

GetAdaptersAddresses

netapi32

Netbios

crypt32

CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertDuplicateCertificateContext

wldap32

ord41
ord208
ord216
ord14
ord46
ord219
ord145
ord301
ord147
ord26
ord133
ord79
ord142
ord117
ord167
ord127
ord27

psapi

GetModuleFileNameExW

Sections

.text
Size: 3.5MB - Virtual size: 3.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 746KB - Virtual size: 745KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 59KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 105KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 209KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/wg/LICENSE.txt
plugins/wg/README.md
plugins/wg/amd64/wireguard.dll
.dll windows:6 windows x64 arch:x64

5c88ee8fdd9dfc27f1d57891a032367a

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:63:d5:fc:a7:28:88:2f:36:ff:1b:df:5d:85:f0:ba
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/12/2018, 00:00

Not After

14/12/2021, 12:00

Subject

SERIALNUMBER=4227913,CN=WireGuard LLC,O=WireGuard LLC,L=Boulder,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d9:8f:09:c2:39:10:67:c8:68:fc:e9:9a:be:7c:4d:49:25:0a:27:91:a1:db:50:5c:11:12:8e:13:b3:28:97:36
Signer

Actual PE Digest

d9:8f:09:c2:39:10:67:c8:68:fc:e9:9a:be:7c:4d:49:25:0a:27:91:a1:db:50:5c:11:12:8e:13:b3:28:97:36

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Jason A. Donenfeld\Projects\wireguard-nt\Release\amd64\wireguard.pdb

Imports

kernel32

HeapCreate
GetCurrentProcess
LoadLibraryExA
CloseHandle
HeapDestroy
GetProcAddress
LocalFree
GetModuleHandleW
IsWow64Process
HeapFree
SetLastError
WaitForSingleObject
CreateFileW
OpenProcess
QueueUserWorkItem
CreateEventW
Sleep
GetLastError
SetEvent
HeapAlloc
GetCurrentProcessId
GetProcessTimes
DeviceIoControl
RemoveDirectoryW
DeleteFileW
MultiByteToWideChar
FormatMessageW
CancelSynchronousIo
CreateThread
EnterCriticalSection
CreatePrivateNamespaceW
OpenPrivateNamespaceW
LeaveCriticalSection
InitializeCriticalSection
CreateBoundaryDescriptorW
CreateMutexW
ReleaseMutex
ClosePrivateNamespace
AddSIDToBoundaryDescriptor
DeleteCriticalSection
DeleteBoundaryDescriptor
ExpandEnvironmentStringsW
HeapReAlloc
CreateDirectoryW
SizeofResource
WriteFile
LockResource
LoadResource
FindResourceW
GetWindowsDirectoryW
ReadFile
SetHandleInformation
CreatePipe
GetExitCodeThread
CreateProcessW
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapSize
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle

ntdll

NtQuerySystemInformation
RtlNtStatusToDosError
RtlGetNtVersionNumbers
NtQueryKey
NtQuerySystemTime

Exports

Exports

WireGuardCloseAdapter
WireGuardCreateAdapter
WireGuardDeleteDriver
WireGuardGetAdapterLUID
WireGuardGetAdapterState
WireGuardGetConfiguration
WireGuardGetRunningDriverVersion
WireGuardOpenAdapter
WireGuardSetAdapterLogging
WireGuardSetAdapterState
WireGuardSetConfiguration
WireGuardSetLogger

Sections

.text
Size: 140KB - Virtual size: 140KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/wg/arm/wireguard.dll
.dll windows:6 windows

260931901626e5a1fdcd024efa8ac9a4

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:63:d5:fc:a7:28:88:2f:36:ff:1b:df:5d:85:f0:ba
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/12/2018, 00:00

Not After

14/12/2021, 12:00

Subject

SERIALNUMBER=4227913,CN=WireGuard LLC,O=WireGuard LLC,L=Boulder,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c0:ef:1b:a8:92:87:a2:41:ef:67:a1:ce:31:98:ad:ce:e0:a5:58:a0:ec:5b:3b:bb:46:3f:80:a0:2c:43:00:8c
Signer

Actual PE Digest

c0:ef:1b:a8:92:87:a2:41:ef:67:a1:ce:31:98:ad:ce:e0:a5:58:a0:ec:5b:3b:bb:46:3f:80:a0:2c:43:00:8c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Jason A. Donenfeld\Projects\wireguard-nt\Release\arm\wireguard.pdb

Imports

kernel32

HeapCreate
GetCurrentProcess
LoadLibraryExA
CloseHandle
HeapDestroy
GetProcAddress
LocalFree
GetModuleHandleW
IsWow64Process
HeapFree
SetLastError
WaitForSingleObject
CreateFileW
QueueUserWorkItem
CreateEventW
Sleep
GetLastError
SetEvent
HeapAlloc
GetCurrentProcessId
DeviceIoControl
RemoveDirectoryW
DeleteFileW
MultiByteToWideChar
FormatMessageW
CancelSynchronousIo
CreateThread
EnterCriticalSection
CreatePrivateNamespaceW
OpenPrivateNamespaceW
LeaveCriticalSection
InitializeCriticalSection
CreateBoundaryDescriptorW
CreateMutexW
ReleaseMutex
ClosePrivateNamespace
AddSIDToBoundaryDescriptor
DeleteCriticalSection
DeleteBoundaryDescriptor
ExpandEnvironmentStringsW
HeapReAlloc
CreateDirectoryW
SizeofResource
WriteFile
LockResource
LoadResource
FindResourceW
GetWindowsDirectoryW
ReadFile
SetHandleInformation
CreatePipe
GetExitCodeThread
CreateProcessW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapSize
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
RtlUnwindEx
InterlockedFlushSList
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
RtlLookupFunctionEntry
EncodePointer
RtlPcToFileHeader
ExitProcess
TerminateProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
WriteConsoleW

ntdll

NtQuerySystemInformation
RtlNtStatusToDosError
RtlGetNtVersionNumbers
NtQueryKey
NtQuerySystemTime

Exports

Exports

WireGuardCloseAdapter
WireGuardCreateAdapter
WireGuardDeleteDriver
WireGuardGetAdapterLUID
WireGuardGetAdapterState
WireGuardGetConfiguration
WireGuardGetRunningDriverVersion
WireGuardOpenAdapter
WireGuardSetAdapterLogging
WireGuardSetAdapterState
WireGuardSetConfiguration
WireGuardSetLogger

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1020KB - Virtual size: 1020KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/wg/arm64/wireguard.dll
plugins/wg/include/wireguard.h
plugins/wg/wg.exe
.exe windows:6 windows x64 arch:x64

5da3d3e0ee2474ebccecb60c5860167e

Code Sign

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07/05/2021, 15:43

Not After

07/11/2030, 16:13

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

35:af:b7:7b:9d:34:1f:6a:fc:8f:84:46:ab:31:35:2b
Certificate

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Not Before

07/05/2021, 19:19

Not After

29/12/2040, 23:59

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

7b:d6:c4:fa:c6:e9:ae:f2:48:e4:9a:b3:0b:6f:bc:81
Certificate

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS2,O=Entrust\, Inc.,C=US

Not Before

21/12/2021, 23:23

Not After

21/12/2024, 23:23

Subject

SERIALNUMBER=4227913,CN=WireGuard LLC,O=WireGuard LLC,L=Boulder,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4a:53:8c:28
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07/07/2009, 17:25

Not After

07/12/2030, 17:55

Subject

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4e:40:e4:37:54:ed:e6:8c:00:00:00:00:51:d3:94:7f
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

07/05/2021, 15:43

Not After

07/11/2030, 16:13

Subject

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

25:bc:2b:f3:29:ca:10:7f:1e:a9:ba:88:85:d4:9d:3b
Certificate

Issuer

CN=Entrust Code Signing Root Certification Authority - CSBR1,O=Entrust\, Inc.,C=US

Not Before

07/05/2021, 19:22

Not After

29/12/2040, 23:59

Subject

CN=Entrust Time Stamping CA - TS2,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

74:d9:f2:db:51:3c:22:67:fd:47:9c:36:07:3f:7b:1d
Certificate

Issuer

CN=Entrust Time Stamping CA - TS2,O=Entrust\, Inc.,C=US

Not Before

14/05/2021, 00:00

Not After

14/08/2032, 00:00

Subject

CN=Entrust Timestamp Authority - TSA2,O=Entrust\, Inc.,L=Ottawa,ST=Ontario,C=CA

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

00:7d:83:4c:50:37:21:8f:98:69:7a:9e:62:5a:2c:47:2d:2f:a7:0d:9a:64:a5:dd:ff:7e:b0:27:d4:99:45:6a
Signer

Actual PE Digest

00:7d:83:4c:50:37:21:8f:98:69:7a:9e:62:5a:2c:47:2d:2f:a7:0d:9a:64:a5:dd:ff:7e:b0:27:d4:99:45:6a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlGetNtVersionNumbers

msvcrt

__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__lconv_init
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_commode
_errno
_fdopen
_fileno
_fmode
_fstat64
_initterm
_isatty
_lock
_onexit
_open_osfhandle
_putenv
_strdup
_stricmp
_strnicmp
_time64
_unlock
abort
calloc
exit
fclose
feof
ferror
fflush
fgetc
fopen
fprintf
fputc
fputs
fread
free
ftell
fwrite
getc
getenv
islower
isspace
isupper
localeconv
malloc
memcmp
memcpy
memset
perror
putchar
puts
qsort
realloc
signal
strchr
strcmp
strcspn
strerror
strlen
strncmp
strncpy
strrchr
strtoul
vfprintf
wcslen
wcstombs

kernel32

CloseHandle
CreateFileA
CreateFileW
DeleteCriticalSection
DeviceIoControl
EnterCriticalSection
FindClose
FindFirstFileA
FindNextFileA
FormatMessageW
FreeLibrary
GetConsoleMode
GetLastError
GetProcAddress
GetStartupInfoA
GetStdHandle
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LocalAlloc
LocalFree
MultiByteToWideChar
RaiseException
SetConsoleMode
SetDefaultDllDirectories
SetDllDirectoryA
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte

Sections

.text
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 248B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/wg/x86/wireguard.dll
.dll windows:6 windows x86 arch:x86

b86517f275c22f87587e8168da60cce6

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:20:4d:b4:00:00:00:00:00:27
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:45

Not After

15/04/2021, 19:55

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:63:d5:fc:a7:28:88:2f:36:ff:1b:df:5d:85:f0:ba
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/12/2018, 00:00

Not After

14/12/2021, 12:00

Subject

SERIALNUMBER=4227913,CN=WireGuard LLC,O=WireGuard LLC,L=Boulder,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

85:ae:b4:93:29:49:61:c8:7d:dc:8b:a8:02:55:b1:bf:f8:d2:48:54:af:ab:7b:3c:7a:4b:98:aa:de:b7:c1:79
Signer

Actual PE Digest

85:ae:b4:93:29:49:61:c8:7d:dc:8b:a8:02:55:b1:bf:f8:d2:48:54:af:ab:7b:3c:7a:4b:98:aa:de:b7:c1:79

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Jason A. Donenfeld\Projects\wireguard-nt\Release\x86\wireguard.pdb

Imports

kernel32

HeapCreate
GetCurrentProcess
LoadLibraryExA
CloseHandle
HeapDestroy
GetProcAddress
LocalFree
GetModuleHandleW
IsWow64Process
HeapFree
SetLastError
WaitForSingleObject
CreateFileW
OpenProcess
QueueUserWorkItem
CreateEventW
Sleep
GetLastError
SetEvent
HeapAlloc
GetCurrentProcessId
GetProcessTimes
DeviceIoControl
RemoveDirectoryW
DeleteFileW
MultiByteToWideChar
FormatMessageW
CancelSynchronousIo
CreateThread
EnterCriticalSection
CreatePrivateNamespaceW
OpenPrivateNamespaceW
LeaveCriticalSection
InitializeCriticalSection
CreateBoundaryDescriptorW
CreateMutexW
ReleaseMutex
ClosePrivateNamespace
AddSIDToBoundaryDescriptor
DeleteCriticalSection
DeleteBoundaryDescriptor
ExpandEnvironmentStringsW
HeapReAlloc
CreateDirectoryW
SizeofResource
WriteFile
LockResource
LoadResource
FindResourceW
GetWindowsDirectoryW
ReadFile
SetHandleInformation
CreatePipe
GetExitCodeThread
CreateProcessW
DecodePointer
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapSize
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedFlushSList
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
WriteConsoleW

ntdll

NtQuerySystemInformation
RtlNtStatusToDosError
RtlGetNtVersionNumbers
NtQueryKey
NtQuerySystemTime

Exports

Exports

WireGuardCloseAdapter
WireGuardCreateAdapter
WireGuardDeleteDriver
WireGuardGetAdapterLUID
WireGuardGetAdapterState
WireGuardGetConfiguration
WireGuardGetRunningDriverVersion
WireGuardOpenAdapter
WireGuardSetAdapterLogging
WireGuardSetAdapterState
WireGuardSetConfiguration
WireGuardSetLogger

Sections

.text
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 272B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/windows_updates/Windows6.1-KB3063858-x64.msu
.cab
WSUSSCAN.cab
.cab
package.cab
.cab
core/1
core/10
core/105
core/1068
core/1069
core/1070
core/1071
core/1076
core/1077
core/1078
core/1079
core/1080
core/1081
core/1082
core/1083
core/1085
core/1086
core/1088
core/1093
core/1094
core/1095
core/1096
core/1098
core/1099
core/11
core/1100
core/1101
core/1102
core/1103
core/1104
core/1105
core/1106
core/1107
core/1108
core/1109
core/111
core/1110
core/1111
core/1112
core/1113
core/1117
core/1122
core/1124
core/1131
core/1136
core/1142
core/1143
core/1144
core/1146
core/1147
core/1149
core/115
core/1150
core/1152
core/1153
core/1154
core/1155
core/1156
core/1157
core/1158
core/1159
core/116
core/1160
core/1161
core/1162
core/1163
core/1164
core/1165
core/1166
core/117
core/1174
core/1175
core/118
core/119
core/12
core/120
core/1203
core/121
core/122
core/1227
core/123
core/1231
core/1233
core/1236
core/124
core/1240
core/1246
core/125
core/126
core/1270
core/1271
core/1272
core/1274
core/1276
core/1279
core/13
core/1307
core/1308
core/1337
core/1338
core/1346
core/14
core/15
core/16
core/1653
core/1654
core/1655
core/1656
core/1657
core/1658
core/1659
core/1660
core/1661
core/1662
core/1663
core/1664
core/1665
core/1666
core/1668
core/1669
core/1670
core/1671
core/1672
core/1678
core/1679
core/1682
core/1683
core/1684
core/1685
core/1686
core/1687
core/1688
core/1689
core/1690
core/1691
core/1692
core/1693
core/1694
core/1695
core/1696
core/1697
core/1698
core/1699
core/17
core/1700
core/1701
core/1703
core/1711
core/1717
core/1718
core/1723
core/1724
core/1725
core/1726
core/1727
core/1728
core/1730
core/1731
core/1732
core/1733
core/1734
core/1735
core/1736
core/1737
core/1738
core/1739
core/1740
core/1741
core/1742
core/1743
core/1744
core/1745
core/1746
core/1747
core/1748
core/1749
core/1750
core/1751
core/1753
core/1759
core/1771
core/1774
core/1781
core/1790
core/18
core/1805
core/1817
core/1822
core/1823
core/1824
core/1825
core/1829
core/1831
core/1843
core/1859
core/1860
core/1861
core/1864
core/1866
core/1869
core/1884
core/1885
core/1890
core/1891
core/19
core/1910
core/1911
core/1913
core/1928
core/1935
core/1952
core/1953
core/1956
core/1957
core/1958
core/1982
core/2
core/20
core/2008
core/21
core/22
core/2222
core/2223
core/2224
core/2225
core/2226
core/2227
core/2228
core/2229
core/2230
core/2231
core/2232
core/2233
core/2234
core/2235
core/2236
core/2237
core/2238
core/2239
core/2240
core/2241
core/2242
core/2243
core/2244
core/2245
core/2246
core/2247
core/2248
core/2249
core/2250
core/2251
core/2252
core/2253
core/2254
core/2255
core/2256
core/2257
core/2258
core/2259
core/2260
core/2261
core/2262
core/2263
core/2264
core/2265
core/2266
core/2267
core/2268
core/2269
core/2272
core/2273
core/2274
core/2275
core/2284
core/2285
core/2287
core/2288
core/2289
core/2290
core/2291
core/2292
core/2293
core/2294
core/2295
core/2296
core/2297
core/2298
core/2299
core/23
core/2300
core/2301
core/2302
core/2303
core/2304
core/2305
core/2306
core/2307
core/2308
core/2309
core/2310
core/2311
core/2312
core/2313
core/2314
core/2315
core/2316
core/2317
core/2318
core/2320
core/2321
core/2324
core/2325
core/2340
core/2341
core/2342
core/2345
core/2346
core/2347
core/2348
core/2349
core/2350
core/2360
core/2361
core/2364
core/2365
core/2366
core/2367
core/2369
core/2371
core/2373
core/2382
core/2383
core/2384
core/2386
core/2389
core/2390
core/2392
core/2393
core/2394
core/2396
core/2397
core/2398
core/24
core/2404
core/2406
core/2407
core/2408
core/2409
core/2410
core/2411
core/2413
core/2414
core/2415
core/2416
core/2417
core/2418
core/2419
core/2420
core/2425
core/2426
core/2427
core/2428
core/2429
core/2430
core/2431
core/2432
core/2441
core/2442
core/2443
core/2444
core/2445
core/2446
core/2447
core/2448
core/2449
core/2457
core/2470
core/2477
core/2481
core/2482
core/25
core/254
core/255
core/256
core/257
core/258
core/2597
core/2598
core/2599
core/26
core/2600
core/2601
core/2602
core/2603
core/2604
core/2605
core/2606
core/2607
core/2608
core/2609
core/2610
core/2611
core/2612
core/2613
core/2614
core/2615
core/2616
core/2617
core/2618
core/2619
core/262
core/2620
core/2621
core/2622
core/2623
core/2624
core/2625
core/2626
core/2627
core/2628
core/2629
core/263
core/2630
core/2631
core/2632
core/2633
core/2634
core/2635
core/2636
core/2637
core/2638
core/2639
core/264
core/2640
core/2641
core/2642
core/2643
core/2644
core/2645
core/2648
core/2649
core/265
core/2650
core/2651
core/2652
core/2653
core/2654
core/2655
core/2656
core/2657
core/2658
core/2659
core/266
core/2660
core/2661
core/2662
core/2663
core/2664
core/2665
core/2667
core/2669
core/267
core/2670
core/2671
core/2672
core/2673
core/2674
core/2675
core/2676
core/2677
core/2678
core/2679
core/268
core/2680
core/2681
core/2682
core/2683
core/2684
core/2685
core/2686
core/2687
core/2689
core/269
core/2690
core/2691
core/2692
core/2693
core/2694
core/2695
core/2696
core/2697
core/2698
core/2699
core/27
core/2700
core/2705
core/2706
core/2707
core/2708
core/2709
core/2710
core/2714
core/2715
core/2716
core/2718
core/2721
core/2723
core/2724
core/2725
core/2727
core/2728
core/2729
core/2730
core/2735
core/2736
core/2737
core/274
core/2740
core/2741
core/2743
core/2747
core/2748
core/275
core/2755
core/2756
core/2758
core/2759
core/2762
core/2763
core/2766
core/28
core/2805
core/2806
core/2807
core/2808
core/2809
core/2810
core/2811
core/2812
core/2813
core/2814
core/2815
core/2816
core/2817
core/2818
core/2819
core/2820
core/2821
core/2822
core/2823
core/2824
core/2825
core/2826
core/2827
core/2828
core/2829
core/2830
core/2831
core/2832
core/2833
core/2834
core/2835
core/2837
core/2838
core/2839
core/2840
core/2841
core/2842
core/2843
core/2844
core/2845
core/2846
core/2847
core/2848
core/2849
core/2850
core/2851
core/2852
core/2853
core/2854
core/2855
core/2856
core/2857
core/2858
core/2859
core/286
core/287
core/288
core/289
core/290
core/291
core/292
core/293
core/294
core/295
core/296
core/297
core/298
core/299
core/3
core/300
core/301
core/302
core/303
core/304
core/305
core/306
core/309
core/310
core/324
core/327
core/330
core/331
core/333
core/334
core/335
core/336
core/337
core/338
core/339
core/34
core/340
core/341
core/342
core/343
core/344
core/345
core/346
core/347
core/349
core/35
core/350
core/351
core/352
core/358
core/36
core/361
core/37
core/384
core/385
core/386
core/387
core/4
core/406
core/408
core/41
core/43
core/44
core/46
core/47
core/5
core/6
core/644
core/645
core/646
core/647
core/649
core/65
core/651
core/652
core/653
core/66
core/660
core/661
core/662
core/663
core/664
core/665
core/666
core/669
core/67
core/673
core/674
core/675
core/676
core/677
core/678
core/679
core/68
core/680
core/681
core/682
core/683
core/684
core/685
core/686
core/687
core/688
core/69
core/690
core/692
core/693
core/696
core/697
core/7
core/70
core/701
core/702
core/704
core/705
core/71
core/716
core/717
core/718
core/719
core/72
core/720
core/721
core/724
core/725
core/726
core/727
core/728
core/729
core/73
core/730
core/731
core/732
core/733
core/734
core/735
core/737
core/739
core/740
core/741
core/743
core/754
core/755
core/756
core/757
core/758
core/759
core/760
core/761
core/762
core/763
core/764
core/765
core/766
core/767
core/768
core/771
core/781
core/782
core/790
core/797
core/798
core/799
core/8
core/800
core/812
core/813
core/814
core/815
core/816
core/82
core/829
core/830
core/831
core/832
core/833
core/89
core/9
core/90
core/92
extended/1
extended/10
extended/105
extended/1068
extended/1069
extended/1070
extended/1071
extended/1076
extended/1077
extended/1078
extended/1079
extended/1080
extended/1081
extended/1082
extended/1083
extended/1085
extended/1086
extended/1088
extended/1093
extended/1094
extended/1095
extended/1096
extended/1098
extended/1099
extended/11
extended/1100
extended/1101
extended/1102
extended/1103
extended/1104
extended/1105
extended/1106
extended/1107
extended/1108
extended/1109
extended/111
extended/1110
extended/1111
extended/1112
extended/1113
extended/1117
extended/1122
extended/1124
extended/1131
extended/1136
extended/1142
extended/1143
extended/1144
extended/1146
extended/1147
extended/1149
extended/115
extended/1150
extended/1152
extended/1153
extended/1154
extended/1155
extended/1156
extended/1157
extended/1158
extended/1159
extended/116
extended/1160
extended/1161
extended/1162
extended/1163
extended/1164
extended/1165
extended/1166
extended/117
extended/1174
extended/1175
extended/118
extended/119
extended/12
extended/120
extended/1203
extended/121
extended/122
extended/1227
extended/123
extended/1231
extended/1233
extended/1236
extended/124
extended/1240
extended/1246
extended/125
extended/126
extended/1270
extended/1271
extended/1272
extended/1274
extended/1276
extended/1279
extended/13
extended/1307
extended/1308
extended/1337
extended/1338
extended/1346
extended/14
extended/15
extended/16
extended/1653
extended/1654
extended/1655
extended/1656
extended/1657
extended/1658
extended/1659
extended/1660
extended/1661
extended/1662
extended/1663
extended/1664
extended/1665
extended/1666
extended/1668
extended/1669
extended/1670
extended/1671
extended/1672
extended/1678
extended/1679
extended/1682
extended/1683
extended/1684
extended/1685
extended/1686
extended/1687
extended/1688
extended/1689
extended/1690
extended/1691
extended/1692
extended/1693
extended/1694
extended/1695
extended/1696
extended/1697
extended/1698
extended/1699
extended/17
extended/1700
extended/1701
extended/1703
extended/1711
extended/1717
extended/1718
extended/1723
extended/1724
extended/1725
extended/1726
extended/1727
extended/1728
extended/1730
extended/1731
extended/1732
extended/1733
extended/1734
extended/1735
extended/1736
extended/1737
extended/1738
extended/1739
extended/1740
extended/1741
extended/1742
extended/1743
extended/1744
extended/1745
extended/1746
extended/1747
extended/1748
extended/1749
extended/1750
extended/1751
extended/1753
extended/1759
extended/1771
extended/1774
extended/1781
extended/1790
extended/18
extended/1805
extended/1817
extended/1822
extended/1823
extended/1824
extended/1825
extended/1829
extended/1831
extended/1843
extended/1859
extended/1860
extended/1861
extended/1864
extended/1866
extended/1869
extended/1884
extended/1885
extended/1890
extended/1891
extended/19
extended/1910
extended/1911
extended/1913
extended/1928
extended/1935
extended/1952
extended/1953
extended/1956
extended/1957
extended/1958
extended/1982
extended/2
extended/20
extended/2008
extended/21
extended/22
extended/2222
extended/2223
extended/2224
extended/2225
extended/2226
extended/2227
extended/2228
extended/2229
extended/2230
extended/2231
extended/2232
extended/2233
extended/2234
extended/2235
extended/2236
extended/2237
extended/2238
extended/2239
extended/2240
extended/2241
extended/2242
extended/2243
extended/2244
extended/2245
extended/2246
extended/2247
extended/2248
extended/2249
extended/2250
extended/2251
extended/2252
extended/2253
extended/2254
extended/2255
extended/2256
extended/2257
extended/2258
extended/2259
extended/2260
extended/2261
extended/2262
extended/2263
extended/2264
extended/2265
extended/2266
extended/2267
extended/2268
extended/2269
extended/2272
extended/2273
extended/2274
extended/2275
extended/2284
extended/2285
extended/2287
extended/2288
extended/2289
extended/2290
extended/2291
extended/2292
extended/2293
extended/2294
extended/2295
extended/2296
extended/2297
extended/2298
extended/2299
extended/23
extended/2300
extended/2301
extended/2302
extended/2303
extended/2304
extended/2305
extended/2306
extended/2307
extended/2308
extended/2309
extended/2310
extended/2311
extended/2312
extended/2313
extended/2314
extended/2315
extended/2316
extended/2317
extended/2318
extended/2320
extended/2321
extended/2324
extended/2325
extended/2340
extended/2341
extended/2342
extended/2345
extended/2346
extended/2347
extended/2348
extended/2349
extended/2350
extended/2360
extended/2361
extended/2364
extended/2365
extended/2366
extended/2367
extended/2369
extended/2371
extended/2373
extended/2382
extended/2383
extended/2384
extended/2386
extended/2389
extended/2390
extended/2392
extended/2393
extended/2394
extended/2396
extended/2397
extended/2398
extended/24
extended/2404
extended/2406
extended/2407
extended/2408
extended/2409
extended/2410
extended/2411
extended/2413
extended/2414
extended/2415
extended/2416
extended/2417
extended/2418
extended/2419
extended/2420
extended/2425
extended/2426
extended/2427
extended/2428
extended/2429
extended/2430
extended/2431
extended/2432
extended/2441
extended/2442
extended/2443
extended/2444
extended/2445
extended/2446
extended/2447
extended/2448
extended/2449
extended/2457
extended/2470
extended/2477
extended/2481
extended/2482
extended/25
extended/254
extended/255
extended/256
extended/257
extended/258
extended/2597
extended/2598
extended/2599
extended/26
extended/2600
extended/2601
extended/2602
extended/2603
extended/2604
extended/2605
extended/2606
extended/2607
extended/2608
extended/2609
extended/2610
extended/2611
extended/2612
extended/2613
extended/2614
extended/2615
extended/2616
extended/2617
extended/2618
extended/2619
extended/262
extended/2620
extended/2621
extended/2622
extended/2623
extended/2624
extended/2625
extended/2626
extended/2627
extended/2628
extended/2629
extended/263
extended/2630
extended/2631
extended/2632
extended/2633
extended/2634
extended/2635
extended/2636
extended/2637
extended/2638
extended/2639
extended/264
extended/2640
extended/2641
extended/2642
extended/2643
extended/2644
extended/2645
extended/2648
extended/2649
extended/265
extended/2650
extended/2651
extended/2652
extended/2653
extended/2654
extended/2655
extended/2656
extended/2657
extended/2658
extended/2659
extended/266
extended/2660
extended/2661
extended/2662
extended/2663
extended/2664
extended/2665
extended/2667
extended/2669
extended/267
extended/2670
extended/2671
extended/2672
extended/2673
extended/2674
extended/2675
extended/2676
extended/2677
extended/2678
extended/2679
extended/268
extended/2680
extended/2681
extended/2682
extended/2683
extended/2684
extended/2685
extended/2686
extended/2687
extended/2689
extended/269
extended/2690
extended/2691
extended/2692
extended/2693
extended/2694
extended/2695
extended/2696
extended/2697
extended/2698
extended/2699
extended/27
extended/2700
extended/2705
extended/2706
extended/2707
extended/2708
extended/2709
extended/2710
extended/2714
extended/2715
extended/2716
extended/2718
extended/2721
extended/2723
extended/2724
extended/2725
extended/2727
extended/2728
extended/2729
extended/2730
extended/2735
extended/2736
extended/2737
extended/274
extended/2740
extended/2741
extended/2743
extended/2747
extended/2748
extended/275
extended/2755
extended/2756
extended/2758
extended/2759
extended/2762
extended/2763
extended/2766
extended/28
extended/2805
extended/2806
extended/2807
extended/2808
extended/2809
extended/2810
extended/2811
extended/2812
extended/2813
extended/2814
extended/2815
extended/2816
extended/2817
extended/2818
extended/2819
extended/2820
extended/2821
extended/2822
extended/2823
extended/2824
extended/2825
extended/2826
extended/2827
extended/2828
extended/2829
extended/2830
extended/2831
extended/2832
extended/2833
extended/2834
extended/2835
extended/2837
extended/2838
extended/2839
extended/2840
extended/2841
extended/2842
extended/2843
extended/2844
extended/2845
extended/2846
extended/2847
extended/2848
extended/2849
extended/2850
extended/2851
extended/2852
extended/2853
extended/2854
extended/2855
extended/2856
extended/2857
extended/2858
extended/2859
extended/286
extended/287
extended/288
extended/289
extended/290
extended/291
extended/292
extended/293
extended/294
extended/295
extended/296
extended/297
extended/298
extended/299
extended/3
extended/300
extended/301
extended/302
extended/303
extended/304
extended/305
extended/306
extended/309
extended/310
extended/324
extended/327
extended/330
extended/331
extended/333
extended/334
extended/335
extended/336
extended/337
extended/338
extended/339
extended/34
extended/340
extended/341
extended/342
extended/343
extended/344
extended/345
extended/346
extended/347
extended/349
extended/35
extended/350
extended/351
extended/352
extended/358
extended/36
extended/361
extended/37
extended/384
extended/385
extended/386
extended/387
extended/4
extended/406
extended/408
extended/41
extended/43
extended/44
extended/46
extended/47
extended/5
extended/6
extended/644
extended/645
extended/646
extended/647
extended/649
extended/65
extended/651
extended/652
extended/653
extended/66
extended/660
extended/661
extended/662
extended/663
extended/664
extended/665
extended/666
extended/669
extended/67
extended/673
extended/674
extended/675
extended/676
extended/677
extended/678
extended/679
extended/68
extended/680
extended/681
extended/682
extended/683
extended/684
extended/685
extended/686
extended/687
extended/688
extended/69
extended/690
extended/692
extended/693
extended/696
extended/697
extended/7
extended/70
extended/701
extended/702
extended/704
extended/705
extended/71
extended/716
extended/717
extended/718
extended/719
extended/72
extended/720
extended/721
extended/724
extended/725
extended/726
extended/727
extended/728
extended/729
extended/73
extended/730
extended/731
extended/732
extended/733
extended/734
extended/735
extended/737
extended/739
extended/740
extended/741
extended/743
extended/754
extended/755
extended/756
extended/757
extended/758
extended/759
extended/760
extended/761
extended/762
extended/763
extended/764
extended/765
extended/766
extended/767
extended/768
extended/771
extended/781
extended/782
extended/790
extended/797
extended/798
extended/799
extended/8
extended/800
extended/812
extended/813
extended/814
extended/815
extended/816
extended/82
extended/829
extended/830
extended/831
extended/832
extended/833
extended/89
extended/9
extended/90
extended/92
localized/ar/1
localized/ar/10
localized/ar/1068
localized/ar/1069
localized/ar/1070
localized/ar/1071
localized/ar/1076
localized/ar/1077
localized/ar/1078
localized/ar/1080
localized/ar/1093
localized/ar/11
localized/ar/12
localized/ar/13
localized/ar/14
localized/ar/1653
localized/ar/1654
localized/ar/1655
localized/ar/1656
localized/ar/1657
localized/ar/1658
localized/ar/1659
localized/ar/1669
localized/ar/1728
localized/ar/1753
localized/ar/1805
localized/ar/19
localized/ar/2
localized/ar/2222
localized/ar/2223
localized/ar/2224
localized/ar/2225
localized/ar/2226
localized/ar/2227
localized/ar/2228
localized/ar/2229
localized/ar/2230
localized/ar/2231
localized/ar/2232
localized/ar/2266
localized/ar/2291
localized/ar/2292
localized/ar/23
localized/ar/2324
localized/ar/2382
localized/ar/2383
localized/ar/2384
localized/ar/24
localized/ar/254
localized/ar/255
localized/ar/256
localized/ar/257
localized/ar/258
localized/ar/2597
localized/ar/2598
localized/ar/2599
localized/ar/26
localized/ar/2600
localized/ar/2601
localized/ar/2602
localized/ar/2603
localized/ar/2604
localized/ar/2605
localized/ar/2606
localized/ar/2607
localized/ar/2608
localized/ar/2609
localized/ar/2610
localized/ar/2611
localized/ar/2619
localized/ar/262
localized/ar/2620
localized/ar/264
localized/ar/2673
localized/ar/2697
localized/ar/2698
localized/ar/27
localized/ar/2705
localized/ar/2715
localized/ar/2724
localized/ar/28
localized/ar/2805
localized/ar/2806
localized/ar/2807
localized/ar/2808
localized/ar/2810
localized/ar/2812
localized/ar/2859
localized/ar/3
localized/ar/330
localized/ar/34
localized/ar/35
localized/ar/358
localized/ar/36
localized/ar/361
localized/ar/4
localized/ar/408
localized/ar/5
localized/ar/6
localized/ar/644
localized/ar/645
localized/ar/646
localized/ar/647
localized/ar/649
localized/ar/663
localized/ar/664
localized/ar/665
localized/ar/7
localized/ar/720
localized/ar/739
localized/ar/799
localized/ar/8
localized/ar/800
localized/ar/9
localized/bg/2859
localized/bg/739
localized/cs/1
localized/cs/10
localized/cs/1068
localized/cs/1069
localized/cs/1070
localized/cs/1071
localized/cs/1076
localized/cs/1077
localized/cs/1078
localized/cs/1080
localized/cs/1093
localized/cs/11
localized/cs/12
localized/cs/13
localized/cs/14
localized/cs/1653
localized/cs/1654
localized/cs/1655
localized/cs/1656
localized/cs/1657
localized/cs/1658
localized/cs/1659
localized/cs/1669
localized/cs/1728
localized/cs/1753
localized/cs/1805
localized/cs/19
localized/cs/2
localized/cs/2222
localized/cs/2223
localized/cs/2224
localized/cs/2225
localized/cs/2226
localized/cs/2227
localized/cs/2228
localized/cs/2229
localized/cs/2230
localized/cs/2231
localized/cs/2232
localized/cs/2266
localized/cs/2291
localized/cs/2292
localized/cs/23
localized/cs/2324
localized/cs/2382
localized/cs/2383
localized/cs/2384
localized/cs/24
localized/cs/254
localized/cs/255
localized/cs/256
localized/cs/257
localized/cs/258
localized/cs/2597
localized/cs/2598
localized/cs/2599
localized/cs/26
localized/cs/2600
localized/cs/2601
localized/cs/2602
localized/cs/2603
localized/cs/2604
localized/cs/2605
localized/cs/2606
localized/cs/2607
localized/cs/2608
localized/cs/2609
localized/cs/2610
localized/cs/2611
localized/cs/2619
localized/cs/262
localized/cs/2620
localized/cs/264
localized/cs/2673
localized/cs/2697
localized/cs/2698
localized/cs/27
localized/cs/2705
localized/cs/2715
localized/cs/2724
localized/cs/28
localized/cs/2805
localized/cs/2806
localized/cs/2807
localized/cs/2808
localized/cs/2810
localized/cs/2812
localized/cs/2859
localized/cs/3
localized/cs/330
localized/cs/34
localized/cs/35
localized/cs/358
localized/cs/36
localized/cs/361
localized/cs/4
localized/cs/408
localized/cs/5
localized/cs/6
localized/cs/644
localized/cs/645
localized/cs/646
localized/cs/647
localized/cs/649
localized/cs/663
localized/cs/664
localized/cs/665
localized/cs/7
localized/cs/720
localized/cs/739
localized/cs/799
localized/cs/8
localized/cs/800
localized/cs/9
localized/da/1
localized/da/10
localized/da/1068
localized/da/1069
localized/da/1070
localized/da/1071
localized/da/1076
localized/da/1077
localized/da/1078
localized/da/1080
localized/da/1093
localized/da/11
localized/da/12
localized/da/13
localized/da/14
localized/da/1653
localized/da/1654
localized/da/1655
localized/da/1656
localized/da/1657
localized/da/1658
localized/da/1659
localized/da/1669
localized/da/1728
localized/da/1753
localized/da/1805
localized/da/19
localized/da/2
localized/da/2222
localized/da/2223
localized/da/2224
localized/da/2225
localized/da/2226
localized/da/2227
localized/da/2228
localized/da/2229
localized/da/2230
localized/da/2231
localized/da/2232
localized/da/2266
localized/da/2291
localized/da/2292
localized/da/23
localized/da/2324
localized/da/2382
localized/da/2383
localized/da/2384
localized/da/24
localized/da/254
localized/da/255
localized/da/256
localized/da/257
localized/da/258
localized/da/2597
localized/da/2598
localized/da/2599
localized/da/26
localized/da/2600
localized/da/2601
localized/da/2602
localized/da/2603
localized/da/2604
localized/da/2605
localized/da/2606
localized/da/2607
localized/da/2608
localized/da/2609
localized/da/2610
localized/da/2611
localized/da/2619
localized/da/262
localized/da/2620
localized/da/264
localized/da/2673
localized/da/2697
localized/da/2698
localized/da/27
localized/da/2705
localized/da/2715
localized/da/2724
localized/da/28
localized/da/2805
localized/da/2806
localized/da/2807
localized/da/2808
localized/da/2810
localized/da/2812
localized/da/2859
localized/da/3
localized/da/330
localized/da/34
localized/da/35
localized/da/358
localized/da/36
localized/da/361
localized/da/4
localized/da/408
localized/da/5
localized/da/6
localized/da/644
localized/da/645
localized/da/646
localized/da/647
localized/da/649
localized/da/663
localized/da/664
localized/da/665
localized/da/7
localized/da/720
localized/da/739
localized/da/799
localized/da/8
localized/da/800
localized/da/9
localized/de/1
localized/de/10
localized/de/1068
localized/de/1069
localized/de/1070
localized/de/1071
localized/de/1076
localized/de/1077
localized/de/1078
localized/de/1080
localized/de/1093
localized/de/11
localized/de/12
localized/de/13
localized/de/14
localized/de/1653
localized/de/1654
localized/de/1655
localized/de/1656
localized/de/1657
localized/de/1658
localized/de/1659
localized/de/1669
localized/de/1728
localized/de/1753
localized/de/1805
localized/de/19
localized/de/2
localized/de/2222
localized/de/2223
localized/de/2224
localized/de/2225
localized/de/2226
localized/de/2227
localized/de/2228
localized/de/2229
localized/de/2230
localized/de/2231
localized/de/2232
localized/de/2266
localized/de/2273
localized/de/2291
localized/de/2292
localized/de/23
localized/de/2324
localized/de/2382
localized/de/2383
localized/de/2384
localized/de/24
localized/de/254
localized/de/255
localized/de/256
localized/de/257
localized/de/258
localized/de/2597
localized/de/2598
localized/de/2599
localized/de/26
localized/de/2600
localized/de/2601
localized/de/2602
localized/de/2603
localized/de/2604
localized/de/2605
localized/de/2606
localized/de/2607
localized/de/2608
localized/de/2609
localized/de/2610
localized/de/2611
localized/de/2619
localized/de/262
localized/de/2620
localized/de/264
localized/de/2673
localized/de/2697
localized/de/2698
localized/de/27
localized/de/2705
localized/de/2715
localized/de/2724
localized/de/28
localized/de/2805
localized/de/2806
localized/de/2807
localized/de/2808
localized/de/2810
localized/de/2812
localized/de/2859
localized/de/3
localized/de/330
localized/de/34
localized/de/35
localized/de/358
localized/de/36
localized/de/361
localized/de/4
localized/de/408
localized/de/5
localized/de/6
localized/de/644
localized/de/645
localized/de/646
localized/de/647
localized/de/649
localized/de/663
localized/de/664
localized/de/665
localized/de/7
localized/de/720
localized/de/739
localized/de/799
localized/de/8
localized/de/800
localized/de/9
localized/el/1
localized/el/10
localized/el/1068
localized/el/1069
localized/el/1070
localized/el/1071
localized/el/1076
localized/el/1077
localized/el/1078
localized/el/1080
localized/el/1093
localized/el/11
localized/el/12
localized/el/13
localized/el/14
localized/el/1653
localized/el/1654
localized/el/1655
localized/el/1656
localized/el/1657
localized/el/1658
localized/el/1659
localized/el/1669
localized/el/1728
localized/el/1753
localized/el/1805
localized/el/19
localized/el/2
localized/el/2222
localized/el/2223
localized/el/2224
localized/el/2225
localized/el/2226
localized/el/2227
localized/el/2228
localized/el/2229
localized/el/2230
localized/el/2231
localized/el/2232
localized/el/2266
localized/el/2291
localized/el/2292
localized/el/23
localized/el/2324
localized/el/2382
localized/el/2383
localized/el/2384
localized/el/24
localized/el/254
localized/el/255
localized/el/256
localized/el/257
localized/el/258
localized/el/2597
localized/el/2598
localized/el/2599
localized/el/26
localized/el/2600
localized/el/2601
localized/el/2602
localized/el/2603
localized/el/2604
localized/el/2605
localized/el/2606
localized/el/2607
localized/el/2608
localized/el/2609
localized/el/2610
localized/el/2611
localized/el/2619
localized/el/262
localized/el/2620
localized/el/264
localized/el/2673
localized/el/2697
localized/el/2698
localized/el/27
localized/el/2705
localized/el/2715
localized/el/2724
localized/el/28
localized/el/2805
localized/el/2806
localized/el/2807
localized/el/2808
localized/el/2810
localized/el/2812
localized/el/2859
localized/el/3
localized/el/330
localized/el/34
localized/el/35
localized/el/358
localized/el/36
localized/el/361
localized/el/4
localized/el/408
localized/el/5
localized/el/6
localized/el/644
localized/el/645
localized/el/646
localized/el/647
localized/el/649
localized/el/663
localized/el/664
localized/el/665
localized/el/7
localized/el/720
localized/el/739
localized/el/799
localized/el/8
localized/el/800
localized/el/9
localized/en/1
localized/en/10
localized/en/105
localized/en/1068
localized/en/1069
localized/en/1070
localized/en/1071
localized/en/1076
localized/en/1077
localized/en/1078
localized/en/1079
localized/en/1080
localized/en/1081
localized/en/1082
localized/en/1083
localized/en/1085
localized/en/1086
localized/en/1088
localized/en/1093
localized/en/1094
localized/en/1095
localized/en/1096
localized/en/1098
localized/en/1099
localized/en/11
localized/en/1100
localized/en/1101
localized/en/1102
localized/en/1103
localized/en/1104
localized/en/1105
localized/en/1106
localized/en/1107
localized/en/1108
localized/en/1109
localized/en/111
localized/en/1110
localized/en/1111
localized/en/1112
localized/en/1113
localized/en/1117
localized/en/1122
localized/en/1124
localized/en/1131
localized/en/1136
localized/en/1142
localized/en/1143
localized/en/1144
localized/en/1146
localized/en/1147
localized/en/1149
localized/en/115
localized/en/1150
localized/en/1152
localized/en/1153
localized/en/1154
localized/en/1155
localized/en/1156
localized/en/1157
localized/en/1158
localized/en/1159
localized/en/116
localized/en/1160
localized/en/1161
localized/en/1162
localized/en/1163
localized/en/1164
localized/en/1165
localized/en/1166
localized/en/117
localized/en/1174
localized/en/1175
localized/en/118
localized/en/119
localized/en/12
localized/en/120
localized/en/1203
localized/en/121
localized/en/122
localized/en/1227
localized/en/123
localized/en/1231
localized/en/1233
localized/en/1236
localized/en/124
localized/en/1240
localized/en/1246
localized/en/125
localized/en/126
localized/en/1270
localized/en/1271
localized/en/1272
localized/en/1274
localized/en/1276
localized/en/1279
localized/en/13
localized/en/1307
localized/en/1308
localized/en/1337
localized/en/1338
localized/en/1346
localized/en/14
localized/en/15
localized/en/16
localized/en/1653
localized/en/1654
localized/en/1655
localized/en/1656
localized/en/1657
localized/en/1658
localized/en/1659
localized/en/1660
localized/en/1661
localized/en/1662
localized/en/1663
localized/en/1664
localized/en/1665
localized/en/1666
localized/en/1668
localized/en/1669
localized/en/1670
localized/en/1671
localized/en/1672
localized/en/1678
localized/en/1679
localized/en/1682
localized/en/1683
localized/en/1684
localized/en/1685
localized/en/1686
localized/en/1687
localized/en/1688
localized/en/1689
localized/en/1690
localized/en/1691
localized/en/1692
localized/en/1693
localized/en/1694
localized/en/1695
localized/en/1696
localized/en/1697
localized/en/1698
localized/en/1699
localized/en/17
localized/en/1700
localized/en/1701
localized/en/1703
localized/en/1711
localized/en/1717
localized/en/1718
localized/en/1723
localized/en/1724
localized/en/1725
localized/en/1726
localized/en/1727
localized/en/1728
localized/en/1730
localized/en/1731
localized/en/1732
localized/en/1733
localized/en/1734
localized/en/1735
localized/en/1736
localized/en/1737
localized/en/1738
localized/en/1739
localized/en/1740
localized/en/1741
localized/en/1742
localized/en/1743
localized/en/1744
localized/en/1745
localized/en/1746
localized/en/1747
localized/en/1748
localized/en/1749
localized/en/1750
localized/en/1751
localized/en/1753
localized/en/1759
localized/en/1771
localized/en/1774
localized/en/1781
localized/en/1790
localized/en/18
localized/en/1805
localized/en/1817
localized/en/1822
localized/en/1823
localized/en/1824
localized/en/1825
localized/en/1829
localized/en/1831
localized/en/1843
localized/en/1859
localized/en/1860
localized/en/1861
localized/en/1864
localized/en/1866
localized/en/1869
localized/en/1884
localized/en/1885
localized/en/1890
localized/en/1891
localized/en/19
localized/en/1910
localized/en/1911
localized/en/1913
localized/en/1928
localized/en/1935
localized/en/1952
localized/en/1953
localized/en/1956
localized/en/1957
localized/en/1958
localized/en/1982
localized/en/2
localized/en/20
localized/en/2008
localized/en/21
localized/en/22
localized/en/2222
localized/en/2223
localized/en/2224
localized/en/2225
localized/en/2226
localized/en/2227
localized/en/2228
localized/en/2229
localized/en/2230
localized/en/2231
localized/en/2232
localized/en/2233
localized/en/2234
localized/en/2235
localized/en/2236
localized/en/2237
localized/en/2238
localized/en/2239
localized/en/2240
localized/en/2241
localized/en/2242
localized/en/2243
localized/en/2244
localized/en/2245
localized/en/2246
localized/en/2247
localized/en/2248
localized/en/2249
localized/en/2250
localized/en/2251
localized/en/2252
localized/en/2253
localized/en/2254
localized/en/2255
localized/en/2256
localized/en/2257
localized/en/2258
localized/en/2259
localized/en/2260
localized/en/2261
localized/en/2262
localized/en/2263
localized/en/2264
localized/en/2265
localized/en/2266
localized/en/2267
localized/en/2268
localized/en/2269
localized/en/2272
localized/en/2273
localized/en/2274
localized/en/2275
localized/en/2284
localized/en/2285
localized/en/2287
localized/en/2288
localized/en/2289
localized/en/2290
localized/en/2291
localized/en/2292
localized/en/2293
localized/en/2294
localized/en/2295
localized/en/2296
localized/en/2297
localized/en/2298
localized/en/2299
localized/en/23
localized/en/2300
localized/en/2301
localized/en/2302
localized/en/2303
localized/en/2304
localized/en/2305
localized/en/2306
localized/en/2307
localized/en/2308
localized/en/2309
localized/en/2310
localized/en/2311
localized/en/2312
localized/en/2313
localized/en/2314
localized/en/2315
localized/en/2316
localized/en/2317
localized/en/2318
localized/en/2320
localized/en/2321
localized/en/2324
localized/en/2325
localized/en/2340
localized/en/2341
localized/en/2342
localized/en/2345
localized/en/2346
localized/en/2347
localized/en/2348
localized/en/2349
localized/en/2350
localized/en/2360
localized/en/2361
localized/en/2364
localized/en/2365
localized/en/2366
localized/en/2367
localized/en/2369
localized/en/2371
localized/en/2373
localized/en/2382
localized/en/2383
localized/en/2384
localized/en/2386
localized/en/2389
localized/en/2390
localized/en/2392
localized/en/2393
localized/en/2394
localized/en/2396
localized/en/2397
localized/en/2398
localized/en/24
localized/en/2404
localized/en/2406
localized/en/2407
localized/en/2408
localized/en/2409
localized/en/2410
localized/en/2411
localized/en/2413
localized/en/2414
localized/en/2415
localized/en/2416
localized/en/2417
localized/en/2418
localized/en/2419
localized/en/2420
localized/en/2425
localized/en/2426
localized/en/2427
localized/en/2428
localized/en/2429
localized/en/2430
localized/en/2431
localized/en/2432
localized/en/2441
localized/en/2442
localized/en/2443
localized/en/2444
localized/en/2445
localized/en/2446
localized/en/2447
localized/en/2448
localized/en/2449
localized/en/2457
localized/en/2470
localized/en/2477
localized/en/2481
localized/en/2482
localized/en/25
localized/en/254
localized/en/255
localized/en/256
localized/en/257
localized/en/258
localized/en/2597
localized/en/2598
localized/en/2599
localized/en/26
localized/en/2600
localized/en/2601
localized/en/2602
localized/en/2603
localized/en/2604
localized/en/2605
localized/en/2606
localized/en/2607
localized/en/2608
localized/en/2609
localized/en/2610
localized/en/2611
localized/en/2612
localized/en/2613
localized/en/2614
localized/en/2615
localized/en/2616
localized/en/2617
localized/en/2618
localized/en/2619
localized/en/262
localized/en/2620
localized/en/2621
localized/en/2622
localized/en/2623
localized/en/2624
localized/en/2625
localized/en/2626
localized/en/2627
localized/en/2628
localized/en/2629
localized/en/263
localized/en/2630
localized/en/2631
localized/en/2632
localized/en/2633
localized/en/2634
localized/en/2635
localized/en/2636
localized/en/2637
localized/en/2638
localized/en/2639
localized/en/264
localized/en/2640
localized/en/2641
localized/en/2642
localized/en/2643
localized/en/2644
localized/en/2645
localized/en/2648
localized/en/2649
localized/en/265
localized/en/2650
localized/en/2651
localized/en/2652
localized/en/2653
localized/en/2654
localized/en/2655
localized/en/2656
localized/en/2657
localized/en/2658
localized/en/2659
localized/en/266
localized/en/2660
localized/en/2661
localized/en/2662
localized/en/2663
localized/en/2664
localized/en/2665
localized/en/2667
localized/en/2669
localized/en/267
localized/en/2670
localized/en/2671
localized/en/2672
localized/en/2673
localized/en/2674
localized/en/2675
localized/en/2676
localized/en/2677
localized/en/2678
localized/en/2679
localized/en/268
localized/en/2680
localized/en/2681
localized/en/2682
localized/en/2683
localized/en/2684
localized/en/2685
localized/en/2686
localized/en/2687
localized/en/2689
localized/en/269
localized/en/2690
localized/en/2691
localized/en/2692
localized/en/2693
localized/en/2694
localized/en/2695
localized/en/2696
localized/en/2697
localized/en/2698
localized/en/2699
localized/en/27
localized/en/2700
localized/en/2705
localized/en/2706
localized/en/2707
localized/en/2708
localized/en/2709
localized/en/2710
localized/en/2714
localized/en/2715
localized/en/2716
localized/en/2718
localized/en/2721
localized/en/2723
localized/en/2724
localized/en/2725
localized/en/2727
localized/en/2728
localized/en/2729
localized/en/2730
localized/en/2735
localized/en/2736
localized/en/2737
localized/en/274
localized/en/2740
localized/en/2741
localized/en/2743
localized/en/2747
localized/en/2748
localized/en/275
localized/en/2755
localized/en/2756
localized/en/2758
localized/en/2759
localized/en/2762
localized/en/2763
localized/en/2766
localized/en/28
localized/en/2805
localized/en/2806
localized/en/2807
localized/en/2808
localized/en/2809
localized/en/2810
localized/en/2811
localized/en/2812
localized/en/2813
localized/en/2814
localized/en/2815
localized/en/2816
localized/en/2817
localized/en/2818
localized/en/2819
localized/en/2820
localized/en/2821
localized/en/2822
localized/en/2823
localized/en/2824
localized/en/2825
localized/en/2826
localized/en/2827
localized/en/2828
localized/en/2829
localized/en/2830
localized/en/2831
localized/en/2832
localized/en/2833
localized/en/2834
localized/en/2835
localized/en/2837
localized/en/2838
localized/en/2839
localized/en/2840
localized/en/2841
localized/en/2842
localized/en/2843
localized/en/2844
localized/en/2845
localized/en/2846
localized/en/2847
localized/en/2848
localized/en/2849
localized/en/2850
localized/en/2851
localized/en/2852
localized/en/2853
localized/en/2854
localized/en/2855
localized/en/2856
localized/en/2857
localized/en/2858
localized/en/2859
localized/en/286
localized/en/287
localized/en/288
localized/en/289
localized/en/290
localized/en/291
localized/en/292
localized/en/293
localized/en/294
localized/en/295
localized/en/296
localized/en/297
localized/en/298
localized/en/299
localized/en/3
localized/en/300
localized/en/301
localized/en/302
localized/en/303
localized/en/304
localized/en/305
localized/en/306
localized/en/309
localized/en/310
localized/en/324
localized/en/327
localized/en/330
localized/en/331
localized/en/333
localized/en/334
localized/en/335
localized/en/336
localized/en/337
localized/en/338
localized/en/339
localized/en/34
localized/en/340
localized/en/341
localized/en/342
localized/en/343
localized/en/344
localized/en/345
localized/en/346
localized/en/347
localized/en/349
localized/en/35
localized/en/350
localized/en/351
localized/en/352
localized/en/358
localized/en/36
localized/en/361
localized/en/37
localized/en/384
localized/en/385
localized/en/386
localized/en/387
localized/en/4
localized/en/406
localized/en/408
localized/en/41
localized/en/43
localized/en/44
localized/en/46
localized/en/47
localized/en/5
localized/en/6
localized/en/644
localized/en/645
localized/en/646
localized/en/647
localized/en/649
localized/en/65
localized/en/651
localized/en/652
localized/en/653
localized/en/66
localized/en/660
localized/en/661
localized/en/662
localized/en/663
localized/en/664
localized/en/665
localized/en/666
localized/en/669
localized/en/67
localized/en/673
localized/en/674
localized/en/675
localized/en/676
localized/en/677
localized/en/678
localized/en/679
localized/en/68
localized/en/680
localized/en/681
localized/en/682
localized/en/683
localized/en/684
localized/en/685
localized/en/686
localized/en/687
localized/en/688
localized/en/69
localized/en/690
localized/en/692
localized/en/693
localized/en/696
localized/en/697
localized/en/7
localized/en/70
localized/en/701
localized/en/702
localized/en/704
localized/en/705
localized/en/71
localized/en/716
localized/en/717
localized/en/718
localized/en/719
localized/en/72
localized/en/720
localized/en/721
localized/en/724
localized/en/725
localized/en/726
localized/en/727
localized/en/728
localized/en/729
localized/en/73
localized/en/730
localized/en/731
localized/en/732
localized/en/733
localized/en/734
localized/en/735
localized/en/737
localized/en/739
localized/en/740
localized/en/741
localized/en/743
localized/en/754
localized/en/755
localized/en/756
localized/en/757
localized/en/758
localized/en/759
localized/en/760
localized/en/761
localized/en/762
localized/en/763
localized/en/764
localized/en/765
localized/en/766
localized/en/767
localized/en/768
localized/en/771
localized/en/781
localized/en/782
localized/en/790
localized/en/797
localized/en/798
localized/en/799
localized/en/8
localized/en/800
localized/en/812
localized/en/813
localized/en/814
localized/en/815
localized/en/816
localized/en/82
localized/en/829
localized/en/830
localized/en/831
localized/en/832
localized/en/833
localized/en/89
localized/en/9
localized/en/90
localized/en/92
localized/es/1
localized/es/10
localized/es/1068
localized/es/1069
localized/es/1070
localized/es/1071
localized/es/1076
localized/es/1077
localized/es/1078
localized/es/1080
localized/es/1093
localized/es/11
localized/es/12
localized/es/13
localized/es/14
localized/es/1653
localized/es/1654
localized/es/1655
localized/es/1656
localized/es/1657
localized/es/1658
localized/es/1659
localized/es/1669
localized/es/1728
localized/es/1753
localized/es/1805
localized/es/19
localized/es/2
localized/es/2222
localized/es/2223
localized/es/2224
localized/es/2225
localized/es/2226
localized/es/2227
localized/es/2228
localized/es/2229
localized/es/2230
localized/es/2231
localized/es/2232
localized/es/2266
localized/es/2273
localized/es/2291
localized/es/2292
localized/es/23
localized/es/2324
localized/es/2382
localized/es/2383
localized/es/2384
localized/es/24
localized/es/254
localized/es/255
localized/es/256
localized/es/257
localized/es/258
localized/es/2597
localized/es/2598
localized/es/2599
localized/es/26
localized/es/2600
localized/es/2601
localized/es/2602
localized/es/2603
localized/es/2604
localized/es/2605
localized/es/2606
localized/es/2607
localized/es/2608
localized/es/2609
localized/es/2610
localized/es/2611
localized/es/2619
localized/es/262
localized/es/2620
localized/es/264
localized/es/2673
localized/es/2697
localized/es/2698
localized/es/27
localized/es/2705
localized/es/2715
localized/es/2724
localized/es/28
localized/es/2805
localized/es/2806
localized/es/2807
localized/es/2808
localized/es/2810
localized/es/2812
localized/es/2859
localized/es/3
localized/es/330
localized/es/34
localized/es/35
localized/es/358
localized/es/36
localized/es/361
localized/es/4
localized/es/408
localized/es/5
localized/es/6
localized/es/644
localized/es/645
localized/es/646
localized/es/647
localized/es/649
localized/es/663
localized/es/664
localized/es/665
localized/es/7
localized/es/720
localized/es/739
localized/es/799
localized/es/8
localized/es/800
localized/es/9
localized/et/2859
localized/et/739
localized/fi/1
localized/fi/10
localized/fi/1068
localized/fi/1069
localized/fi/1070
localized/fi/1071
localized/fi/1076
localized/fi/1077
localized/fi/1078
localized/fi/1080
localized/fi/1093
localized/fi/11
localized/fi/12
localized/fi/13
localized/fi/14
localized/fi/1653
localized/fi/1654
localized/fi/1655
localized/fi/1656
localized/fi/1657
localized/fi/1658
localized/fi/1659
localized/fi/1669
localized/fi/1728
localized/fi/1753
localized/fi/1805
localized/fi/19
localized/fi/2
localized/fi/2222
localized/fi/2223
localized/fi/2224
localized/fi/2225
localized/fi/2226
localized/fi/2227
localized/fi/2228
localized/fi/2229
localized/fi/2230
localized/fi/2231
localized/fi/2232
localized/fi/2266
localized/fi/2291
localized/fi/2292
localized/fi/23
localized/fi/2324
localized/fi/2382
localized/fi/2383
localized/fi/2384
localized/fi/24
localized/fi/254
localized/fi/255
localized/fi/256
localized/fi/257
localized/fi/258
localized/fi/2597
localized/fi/2598
localized/fi/2599
localized/fi/26
localized/fi/2600
localized/fi/2601
localized/fi/2602
localized/fi/2603
localized/fi/2604
localized/fi/2605
localized/fi/2606
localized/fi/2607
localized/fi/2608
localized/fi/2609
localized/fi/2610
localized/fi/2611
localized/fi/2619
localized/fi/262
localized/fi/2620
localized/fi/264
localized/fi/2673
localized/fi/2697
localized/fi/2698
localized/fi/27
localized/fi/2705
localized/fi/2715
localized/fi/2724
localized/fi/28
localized/fi/2805
localized/fi/2806
localized/fi/2807
localized/fi/2808
localized/fi/2810
localized/fi/2812
localized/fi/2859
localized/fi/3
localized/fi/330
localized/fi/34
localized/fi/35
localized/fi/358
localized/fi/36
localized/fi/361
localized/fi/4
localized/fi/408
localized/fi/5
localized/fi/6
localized/fi/644
localized/fi/645
localized/fi/646
localized/fi/647
localized/fi/649
localized/fi/663
localized/fi/664
localized/fi/665
localized/fi/7
localized/fi/720
localized/fi/739
localized/fi/799
localized/fi/8
localized/fi/800
localized/fi/9
localized/fr/1
localized/fr/10
localized/fr/1068
localized/fr/1069
localized/fr/1070
localized/fr/1071
localized/fr/1076
localized/fr/1077
localized/fr/1078
localized/fr/1080
localized/fr/1093
localized/fr/11
localized/fr/12
localized/fr/13
localized/fr/14
localized/fr/1653
localized/fr/1654
localized/fr/1655
localized/fr/1656
localized/fr/1657
localized/fr/1658
localized/fr/1659
localized/fr/1669
localized/fr/1728
localized/fr/1753
localized/fr/1805
localized/fr/19
localized/fr/2
localized/fr/2222
localized/fr/2223
localized/fr/2224
localized/fr/2225
localized/fr/2226
localized/fr/2227
localized/fr/2228
localized/fr/2229
localized/fr/2230
localized/fr/2231
localized/fr/2232
localized/fr/2266
localized/fr/2273
localized/fr/2291
localized/fr/2292
localized/fr/23
localized/fr/2324
localized/fr/2382
localized/fr/2383
localized/fr/2384
localized/fr/24
localized/fr/254
localized/fr/255
localized/fr/256
localized/fr/257
localized/fr/258
localized/fr/2597
localized/fr/2598
localized/fr/2599
localized/fr/26
localized/fr/2600
localized/fr/2601
localized/fr/2602
localized/fr/2603
localized/fr/2604
localized/fr/2605
localized/fr/2606
localized/fr/2607
localized/fr/2608
localized/fr/2609
localized/fr/2610
localized/fr/2611
localized/fr/2619
localized/fr/262
localized/fr/2620
localized/fr/264
localized/fr/2673
localized/fr/2697
localized/fr/2698
localized/fr/27
localized/fr/2705
localized/fr/2715
localized/fr/2724
localized/fr/28
localized/fr/2805
localized/fr/2806
localized/fr/2807
localized/fr/2808
localized/fr/2810
localized/fr/2812
localized/fr/2859
localized/fr/3
localized/fr/330
localized/fr/34
localized/fr/35
localized/fr/358
localized/fr/36
localized/fr/361
localized/fr/4
localized/fr/408
localized/fr/5
localized/fr/6
localized/fr/644
localized/fr/645
localized/fr/646
localized/fr/647
localized/fr/649
localized/fr/663
localized/fr/664
localized/fr/665
localized/fr/7
localized/fr/720
localized/fr/739
localized/fr/799
localized/fr/8
localized/fr/800
localized/fr/9
localized/he/1
localized/he/10
localized/he/1068
localized/he/1069
localized/he/1070
localized/he/1071
localized/he/1076
localized/he/1077
localized/he/1078
localized/he/1080
localized/he/1093
localized/he/11
localized/he/12
localized/he/13
localized/he/14
localized/he/1653
localized/he/1654
localized/he/1655
localized/he/1656
localized/he/1657
localized/he/1658
localized/he/1659
localized/he/1669
localized/he/1728
localized/he/1753
localized/he/1805
localized/he/19
localized/he/2
localized/he/2222
localized/he/2223
localized/he/2224
localized/he/2225
localized/he/2226
localized/he/2227
localized/he/2228
localized/he/2229
localized/he/2230
localized/he/2231
localized/he/2232
localized/he/2266
localized/he/2291
localized/he/2292
localized/he/23
localized/he/2324
localized/he/2382
localized/he/2383
localized/he/2384
localized/he/24
localized/he/254
localized/he/255
localized/he/256
localized/he/257
localized/he/258
localized/he/2597
localized/he/2598
localized/he/2599
localized/he/26
localized/he/2600
localized/he/2601
localized/he/2602
localized/he/2603
localized/he/2604
localized/he/2605
localized/he/2606
localized/he/2607
localized/he/2608
localized/he/2609
localized/he/2610
localized/he/2611
localized/he/2619
localized/he/262
localized/he/2620
localized/he/264
localized/he/2673
localized/he/2697
localized/he/2698
localized/he/27
localized/he/2705
localized/he/2715
localized/he/2724
localized/he/28
localized/he/2805
localized/he/2806
localized/he/2807
localized/he/2808
localized/he/2810
localized/he/2812
localized/he/2859
localized/he/3
localized/he/330
localized/he/34
localized/he/35
localized/he/358
localized/he/36
localized/he/361
localized/he/4
localized/he/408
localized/he/5
localized/he/6
localized/he/644
localized/he/645
localized/he/646
localized/he/647
localized/he/649
localized/he/663
localized/he/664
localized/he/665
localized/he/7
localized/he/720
localized/he/739
localized/he/799
localized/he/8
localized/he/800
localized/he/9
localized/hr/2859
localized/hr/739
localized/hu/1
localized/hu/10
localized/hu/1068
localized/hu/1069
localized/hu/1070
localized/hu/1071
localized/hu/1076
localized/hu/1077
localized/hu/1078
localized/hu/1080
localized/hu/1093
localized/hu/11
localized/hu/12
localized/hu/13
localized/hu/14
localized/hu/1653
localized/hu/1654
localized/hu/1655
localized/hu/1656
localized/hu/1657
localized/hu/1658
localized/hu/1659
localized/hu/1669
localized/hu/1728
localized/hu/1753
localized/hu/1805
localized/hu/19
localized/hu/2
localized/hu/2222
localized/hu/2223
localized/hu/2224
localized/hu/2225
localized/hu/2226
localized/hu/2227
localized/hu/2228
localized/hu/2229
localized/hu/2230
localized/hu/2231
localized/hu/2232
localized/hu/2266
localized/hu/2291
localized/hu/2292
localized/hu/23
localized/hu/2324
localized/hu/2382
localized/hu/2383
localized/hu/2384
localized/hu/24
localized/hu/254
localized/hu/255
localized/hu/256
localized/hu/257
localized/hu/258
localized/hu/2597
localized/hu/2598
localized/hu/2599
localized/hu/26
localized/hu/2600
localized/hu/2601
localized/hu/2602
localized/hu/2603
localized/hu/2604
localized/hu/2605
localized/hu/2606
localized/hu/2607
localized/hu/2608
localized/hu/2609
localized/hu/2610
localized/hu/2611
localized/hu/2619
localized/hu/262
localized/hu/2620
localized/hu/264
localized/hu/2673
localized/hu/2697
localized/hu/2698
localized/hu/27
localized/hu/2705
localized/hu/2715
localized/hu/2724
localized/hu/28
localized/hu/2805
localized/hu/2806
localized/hu/2807
localized/hu/2808
localized/hu/2810
localized/hu/2812
localized/hu/2859
localized/hu/3
localized/hu/330
localized/hu/34
localized/hu/35
localized/hu/358
localized/hu/36
localized/hu/361
localized/hu/4
localized/hu/408
localized/hu/5
localized/hu/6
localized/hu/644
localized/hu/645
localized/hu/646
localized/hu/647
localized/hu/649
localized/hu/663
localized/hu/664
localized/hu/665
localized/hu/7
localized/hu/720
localized/hu/739
localized/hu/799
localized/hu/8
localized/hu/800
localized/hu/9
localized/it/1
localized/it/10
localized/it/1068
localized/it/1069
localized/it/1070
localized/it/1071
localized/it/1076
localized/it/1077
localized/it/1078
localized/it/1080
localized/it/1093
localized/it/11
localized/it/12
localized/it/13
localized/it/14
localized/it/1653
localized/it/1654
localized/it/1655
localized/it/1656
localized/it/1657
localized/it/1658
localized/it/1659
localized/it/1669
localized/it/1728
localized/it/1753
localized/it/1805
localized/it/19
localized/it/2
localized/it/2222
localized/it/2223
localized/it/2224
localized/it/2225
localized/it/2226
localized/it/2227
localized/it/2228
localized/it/2229
localized/it/2230
localized/it/2231
localized/it/2232
localized/it/2266
localized/it/2273
localized/it/2291
localized/it/2292
localized/it/23
localized/it/2324
localized/it/2382
localized/it/2383
localized/it/2384
localized/it/24
localized/it/254
localized/it/255
localized/it/256
localized/it/257
localized/it/258
localized/it/2597
localized/it/2598
localized/it/2599
localized/it/26
localized/it/2600
localized/it/2601
localized/it/2602
localized/it/2603
localized/it/2604
localized/it/2605
localized/it/2606
localized/it/2607
localized/it/2608
localized/it/2609
localized/it/2610
localized/it/2611
localized/it/2619
localized/it/262
localized/it/2620
localized/it/264
localized/it/2673
localized/it/2697
localized/it/2698
localized/it/27
localized/it/2705
localized/it/2715
localized/it/2724
localized/it/28
localized/it/2805
localized/it/2806
localized/it/2807
localized/it/2808
localized/it/2810
localized/it/2812
localized/it/2859
localized/it/3
localized/it/330
localized/it/34
localized/it/35
localized/it/358
localized/it/36
localized/it/361
localized/it/4
localized/it/408
localized/it/5
localized/it/6
localized/it/644
localized/it/645
localized/it/646
localized/it/647
localized/it/649
localized/it/663
localized/it/664
localized/it/665
localized/it/7
localized/it/720
localized/it/739
localized/it/799
localized/it/8
localized/it/800
localized/it/9
localized/ja/1
localized/ja/10
localized/ja/1068
localized/ja/1069
localized/ja/1070
localized/ja/1071
localized/ja/1076
localized/ja/1077
localized/ja/1078
localized/ja/1080
localized/ja/1093
localized/ja/11
localized/ja/12
localized/ja/13
localized/ja/14
localized/ja/1653
localized/ja/1654
localized/ja/1655
localized/ja/1656
localized/ja/1657
localized/ja/1658
localized/ja/1659
localized/ja/1669
localized/ja/1728
localized/ja/1753
localized/ja/1805
localized/ja/19
localized/ja/2
localized/ja/2222
localized/ja/2223
localized/ja/2224
localized/ja/2225
localized/ja/2226
localized/ja/2227
localized/ja/2228
localized/ja/2229
localized/ja/2230
localized/ja/2231
localized/ja/2232
localized/ja/2266
localized/ja/2273
localized/ja/2291
localized/ja/2292
localized/ja/23
localized/ja/2324
localized/ja/2382
localized/ja/2383
localized/ja/2384
localized/ja/24
localized/ja/254
localized/ja/255
localized/ja/256
localized/ja/257
localized/ja/258
localized/ja/2597
localized/ja/2598
localized/ja/2599
localized/ja/26
localized/ja/2600
localized/ja/2601
localized/ja/2602
localized/ja/2603
localized/ja/2604
localized/ja/2605
localized/ja/2606
localized/ja/2607
localized/ja/2608
localized/ja/2609
localized/ja/2610
localized/ja/2611
localized/ja/2619
localized/ja/262
localized/ja/2620
localized/ja/264
localized/ja/2673
localized/ja/2697
localized/ja/2698
localized/ja/27
localized/ja/2705
localized/ja/2715
localized/ja/2724
localized/ja/28
localized/ja/2805
localized/ja/2806
localized/ja/2807
localized/ja/2808
localized/ja/2810
localized/ja/2812
localized/ja/2859
localized/ja/3
localized/ja/330
localized/ja/34
localized/ja/35
localized/ja/358
localized/ja/36
localized/ja/361
localized/ja/4
localized/ja/408
localized/ja/5
localized/ja/6
localized/ja/644
localized/ja/645
localized/ja/646
localized/ja/647
localized/ja/649
localized/ja/663
localized/ja/664
localized/ja/665
localized/ja/7
localized/ja/720
localized/ja/739
localized/ja/799
localized/ja/8
localized/ja/800
localized/ja/9
localized/ko/1
localized/ko/10
localized/ko/1068
localized/ko/1069
localized/ko/1070
localized/ko/1071
localized/ko/1076
localized/ko/1077
localized/ko/1078
localized/ko/1080
localized/ko/1093
localized/ko/11
localized/ko/12
localized/ko/13
localized/ko/14
localized/ko/1653
localized/ko/1654
localized/ko/1655
localized/ko/1656
localized/ko/1657
localized/ko/1658
localized/ko/1659
localized/ko/1669
localized/ko/1728
localized/ko/1753
localized/ko/1805
localized/ko/19
localized/ko/2
localized/ko/2222
localized/ko/2223
localized/ko/2224
localized/ko/2225
localized/ko/2226
localized/ko/2227
localized/ko/2228
localized/ko/2229
localized/ko/2230
localized/ko/2231
localized/ko/2232
localized/ko/2266
localized/ko/2273
localized/ko/2291
localized/ko/2292
localized/ko/23
localized/ko/2324
localized/ko/2382
localized/ko/2383
localized/ko/2384
localized/ko/24
localized/ko/254
localized/ko/255
localized/ko/256
localized/ko/257
localized/ko/258
localized/ko/2597
localized/ko/2598
localized/ko/2599
localized/ko/26
localized/ko/2600
localized/ko/2601
localized/ko/2602
localized/ko/2603
localized/ko/2604
localized/ko/2605
localized/ko/2606
localized/ko/2607
localized/ko/2608
localized/ko/2609
localized/ko/2610
localized/ko/2611
localized/ko/2619
localized/ko/262
localized/ko/2620
localized/ko/264
localized/ko/2673
localized/ko/2697
localized/ko/2698
localized/ko/27
localized/ko/2705
localized/ko/2715
localized/ko/2724
localized/ko/28
localized/ko/2805
localized/ko/2806
localized/ko/2807
localized/ko/2808
localized/ko/2810
localized/ko/2812
localized/ko/2859
localized/ko/3
localized/ko/330
localized/ko/34
localized/ko/35
localized/ko/358
localized/ko/36
localized/ko/361
localized/ko/4
localized/ko/408
localized/ko/5
localized/ko/6
localized/ko/644
localized/ko/645
localized/ko/646
localized/ko/647
localized/ko/649
localized/ko/663
localized/ko/664
localized/ko/665
localized/ko/7
localized/ko/720
localized/ko/739
localized/ko/799
localized/ko/8
localized/ko/800
localized/ko/9
localized/lt/2859
localized/lt/739
localized/lv/2859
localized/lv/739
localized/neu/2859
localized/nl/1
localized/nl/10
localized/nl/1068
localized/nl/1069
localized/nl/1070
localized/nl/1071
localized/nl/1076
localized/nl/1077
localized/nl/1078
localized/nl/1080
localized/nl/1093
localized/nl/11
localized/nl/12
localized/nl/13
localized/nl/14
localized/nl/1653
localized/nl/1654
localized/nl/1655
localized/nl/1656
localized/nl/1657
localized/nl/1658
localized/nl/1659
localized/nl/1669
localized/nl/1728
localized/nl/1753
localized/nl/1805
localized/nl/19
localized/nl/2
localized/nl/2222
localized/nl/2223
localized/nl/2224
localized/nl/2225
localized/nl/2226
localized/nl/2227
localized/nl/2228
localized/nl/2229
localized/nl/2230
localized/nl/2231
localized/nl/2232
localized/nl/2266
localized/nl/2291
localized/nl/2292
localized/nl/23
localized/nl/2324
localized/nl/2382
localized/nl/2383
localized/nl/2384
localized/nl/24
localized/nl/254
localized/nl/255
localized/nl/256
localized/nl/257
localized/nl/258
localized/nl/2597
localized/nl/2598
localized/nl/2599
localized/nl/26
localized/nl/2600
localized/nl/2601
localized/nl/2602
localized/nl/2603
localized/nl/2604
localized/nl/2605
localized/nl/2606
localized/nl/2607
localized/nl/2608
localized/nl/2609
localized/nl/2610
localized/nl/2611
localized/nl/2619
localized/nl/262
localized/nl/2620
localized/nl/264
localized/nl/2673
localized/nl/2697
localized/nl/2698
localized/nl/27
localized/nl/2705
localized/nl/2715
localized/nl/2724
localized/nl/28
localized/nl/2805
localized/nl/2806
localized/nl/2807
localized/nl/2808
localized/nl/2810
localized/nl/2812
localized/nl/2859
localized/nl/3
localized/nl/330
localized/nl/34
localized/nl/35
localized/nl/358
localized/nl/36
localized/nl/361
localized/nl/4
localized/nl/408
localized/nl/5
localized/nl/6
localized/nl/644
localized/nl/645
localized/nl/646
localized/nl/647
localized/nl/649
localized/nl/663
localized/nl/664
localized/nl/665
localized/nl/7
localized/nl/720
localized/nl/739
localized/nl/799
localized/nl/8
localized/nl/800
localized/nl/9
localized/no/1
localized/no/10
localized/no/1068
localized/no/1069
localized/no/1070
localized/no/1071
localized/no/1076
localized/no/1077
localized/no/1078
localized/no/1080
localized/no/1093
localized/no/11
localized/no/12
localized/no/13
localized/no/14
localized/no/1653
localized/no/1654
localized/no/1655
localized/no/1656
localized/no/1657
localized/no/1658
localized/no/1659
localized/no/1669
localized/no/1728
localized/no/1753
localized/no/1805
localized/no/19
localized/no/2
localized/no/2222
localized/no/2223
localized/no/2224
localized/no/2225
localized/no/2226
localized/no/2227
localized/no/2228
localized/no/2229
localized/no/2230
localized/no/2231
localized/no/2232
localized/no/2266
localized/no/2291
localized/no/2292
localized/no/23
localized/no/2324
localized/no/2382
localized/no/2383
localized/no/2384
localized/no/24
localized/no/254
localized/no/255
localized/no/256
localized/no/257
localized/no/258
localized/no/2597
localized/no/2598
localized/no/2599
localized/no/26
localized/no/2600
localized/no/2601
localized/no/2602
localized/no/2603
localized/no/2604
localized/no/2605
localized/no/2606
localized/no/2607
localized/no/2608
localized/no/2609
localized/no/2610
localized/no/2611
localized/no/2619
localized/no/262
localized/no/2620
localized/no/264
localized/no/2673
localized/no/2697
localized/no/2698
localized/no/27
localized/no/2705
localized/no/2715
localized/no/2724
localized/no/28
localized/no/2805
localized/no/2806
localized/no/2807
localized/no/2808
localized/no/2810
localized/no/2812
localized/no/2859
localized/no/3
localized/no/330
localized/no/34
localized/no/35
localized/no/358
localized/no/36
localized/no/361
localized/no/4
localized/no/408
localized/no/5
localized/no/6
localized/no/644
localized/no/645
localized/no/646
localized/no/647
localized/no/649
localized/no/663
localized/no/664
localized/no/665
localized/no/7
localized/no/720
localized/no/739
localized/no/799
localized/no/8
localized/no/800
localized/no/9
localized/pl/1
localized/pl/10
localized/pl/1068
localized/pl/1069
localized/pl/1070
localized/pl/1071
localized/pl/1076
localized/pl/1077
localized/pl/1078
localized/pl/1080
localized/pl/1093
localized/pl/11
localized/pl/12
localized/pl/13
localized/pl/14
localized/pl/1653
localized/pl/1654
localized/pl/1655
localized/pl/1656
localized/pl/1657
localized/pl/1658
localized/pl/1659
localized/pl/1669
localized/pl/1728
localized/pl/1753
localized/pl/1805
localized/pl/19
localized/pl/2
localized/pl/2222
localized/pl/2223
localized/pl/2224
localized/pl/2225
localized/pl/2226
localized/pl/2227
localized/pl/2228
localized/pl/2229
localized/pl/2230
localized/pl/2231
localized/pl/2232
localized/pl/2266
localized/pl/2291
localized/pl/2292
localized/pl/23
localized/pl/2324
localized/pl/2382
localized/pl/2383
localized/pl/2384
localized/pl/24
localized/pl/254
localized/pl/255
localized/pl/256
localized/pl/257
localized/pl/258
localized/pl/2597
localized/pl/2598
localized/pl/2599
localized/pl/26
localized/pl/2600
localized/pl/2601
localized/pl/2602
localized/pl/2603
localized/pl/2604
localized/pl/2605
localized/pl/2606
localized/pl/2607
localized/pl/2608
localized/pl/2609
localized/pl/2610
localized/pl/2611
localized/pl/2619
localized/pl/262
localized/pl/2620
localized/pl/264
localized/pl/2673
localized/pl/2697
localized/pl/2698
localized/pl/27
localized/pl/2705
localized/pl/2715
localized/pl/2724
localized/pl/28
localized/pl/2805
localized/pl/2806
localized/pl/2807
localized/pl/2808
localized/pl/2810
localized/pl/2812
localized/pl/2859
localized/pl/3
localized/pl/330
localized/pl/34
localized/pl/35
localized/pl/358
localized/pl/36
localized/pl/361
localized/pl/4
localized/pl/408
localized/pl/5
localized/pl/6
localized/pl/644
localized/pl/645
localized/pl/646
localized/pl/647
localized/pl/649
localized/pl/663
localized/pl/664
localized/pl/665
localized/pl/7
localized/pl/720
localized/pl/739
localized/pl/799
localized/pl/8
localized/pl/800
localized/pl/9
localized/pt-br/1
localized/pt-br/10
localized/pt-br/1068
localized/pt-br/1069
localized/pt-br/1070
localized/pt-br/1071
localized/pt-br/1076
localized/pt-br/1077
localized/pt-br/1078
localized/pt-br/1080
localized/pt-br/1093
localized/pt-br/11
localized/pt-br/12
localized/pt-br/13
localized/pt-br/14
localized/pt-br/1653
localized/pt-br/1654
localized/pt-br/1655
localized/pt-br/1656
localized/pt-br/1657
localized/pt-br/1658
localized/pt-br/1659
localized/pt-br/1669
localized/pt-br/1728
localized/pt-br/1753
localized/pt-br/1805
localized/pt-br/19
localized/pt-br/2
localized/pt-br/2222
localized/pt-br/2223
localized/pt-br/2224
localized/pt-br/2225
localized/pt-br/2226
localized/pt-br/2227
localized/pt-br/2228
localized/pt-br/2229
localized/pt-br/2230
localized/pt-br/2231
localized/pt-br/2232
localized/pt-br/2266
localized/pt-br/2291
localized/pt-br/2292
localized/pt-br/23
localized/pt-br/2324
localized/pt-br/2382
localized/pt-br/2383
localized/pt-br/2384
localized/pt-br/24
localized/pt-br/254
localized/pt-br/255
localized/pt-br/256
localized/pt-br/257
localized/pt-br/258
localized/pt-br/2597
localized/pt-br/2598
localized/pt-br/2599
localized/pt-br/26
localized/pt-br/2600
localized/pt-br/2601
localized/pt-br/2602
localized/pt-br/2603
localized/pt-br/2604
localized/pt-br/2605
localized/pt-br/2606
localized/pt-br/2607
localized/pt-br/2608
localized/pt-br/2609
localized/pt-br/2610
localized/pt-br/2611
localized/pt-br/2619
localized/pt-br/262
localized/pt-br/2620
localized/pt-br/264
localized/pt-br/2673
localized/pt-br/2697
localized/pt-br/2698
localized/pt-br/27
localized/pt-br/2705
localized/pt-br/2715
localized/pt-br/2724
localized/pt-br/28
localized/pt-br/2805
localized/pt-br/2806
localized/pt-br/2807
localized/pt-br/2808
localized/pt-br/2810
localized/pt-br/2812
localized/pt-br/2859
localized/pt-br/3
localized/pt-br/330
localized/pt-br/34
localized/pt-br/35
localized/pt-br/358
localized/pt-br/36
localized/pt-br/361
localized/pt-br/4
localized/pt-br/408
localized/pt-br/5
localized/pt-br/6
localized/pt-br/644
localized/pt-br/645
localized/pt-br/646
localized/pt-br/647
localized/pt-br/649
localized/pt-br/663
localized/pt-br/664
localized/pt-br/665
localized/pt-br/7
localized/pt-br/720
localized/pt-br/739
localized/pt-br/799
localized/pt-br/8
localized/pt-br/800
localized/pt-br/9
localized/pt/1
localized/pt/10
localized/pt/1068
localized/pt/1069
localized/pt/1070
localized/pt/1071
localized/pt/1076
localized/pt/1077
localized/pt/1078
localized/pt/1080
localized/pt/1093
localized/pt/11
localized/pt/12
localized/pt/13
localized/pt/14
localized/pt/1653
localized/pt/1654
localized/pt/1655
localized/pt/1656
localized/pt/1657
localized/pt/1658
localized/pt/1659
localized/pt/1669
localized/pt/1728
localized/pt/1753
localized/pt/1805
localized/pt/19
localized/pt/2
localized/pt/2222
localized/pt/2223
localized/pt/2224
localized/pt/2225
localized/pt/2226
localized/pt/2227
localized/pt/2228
localized/pt/2229
localized/pt/2230
localized/pt/2231
localized/pt/2232
localized/pt/2266
localized/pt/2291
localized/pt/2292
localized/pt/23
localized/pt/2324
localized/pt/2382
localized/pt/2383
localized/pt/2384
localized/pt/24
localized/pt/254
localized/pt/255
localized/pt/256
localized/pt/257
localized/pt/258
localized/pt/2597
localized/pt/2598
localized/pt/2599
localized/pt/26
localized/pt/2600
localized/pt/2601
localized/pt/2602
localized/pt/2603
localized/pt/2604
localized/pt/2605
localized/pt/2606
localized/pt/2607
localized/pt/2608
localized/pt/2609
localized/pt/2610
localized/pt/2611
localized/pt/2619
localized/pt/262
localized/pt/2620
localized/pt/264
localized/pt/2673
localized/pt/2697
localized/pt/2698
localized/pt/27
localized/pt/2705
localized/pt/2715
localized/pt/2724
localized/pt/28
localized/pt/2805
localized/pt/2806
localized/pt/2807
localized/pt/2808
localized/pt/2810
localized/pt/2812
localized/pt/2859
localized/pt/3
localized/pt/330
localized/pt/34
localized/pt/35
localized/pt/358
localized/pt/36
localized/pt/361
localized/pt/4
localized/pt/408
localized/pt/5
localized/pt/6
localized/pt/644
localized/pt/645
localized/pt/646
localized/pt/647
localized/pt/649
localized/pt/663
localized/pt/664
localized/pt/665
localized/pt/7
localized/pt/720
localized/pt/739
localized/pt/799
localized/pt/8
localized/pt/800
localized/pt/9
localized/ro/2859
localized/ro/739
localized/ru/1
localized/ru/10
localized/ru/1068
localized/ru/1069
localized/ru/1070
localized/ru/1071
localized/ru/1076
localized/ru/1077
localized/ru/1078
localized/ru/1080
localized/ru/1093
localized/ru/11
localized/ru/12
localized/ru/13
localized/ru/14
localized/ru/1653
localized/ru/1654
localized/ru/1655
localized/ru/1656
localized/ru/1657
localized/ru/1658
localized/ru/1659
localized/ru/1669
localized/ru/1728
localized/ru/1753
localized/ru/1805
localized/ru/19
localized/ru/2
localized/ru/2222
localized/ru/2223
localized/ru/2224
localized/ru/2225
localized/ru/2226
localized/ru/2227
localized/ru/2228
localized/ru/2229
localized/ru/2230
localized/ru/2231
localized/ru/2232
localized/ru/2266
localized/ru/2291
localized/ru/2292
localized/ru/23
localized/ru/2324
localized/ru/2382
localized/ru/2383
localized/ru/2384
localized/ru/24
localized/ru/254
localized/ru/255
localized/ru/256
localized/ru/257
localized/ru/258
localized/ru/2597
localized/ru/2598
localized/ru/2599
localized/ru/26
localized/ru/2600
localized/ru/2601
localized/ru/2602
localized/ru/2603
localized/ru/2604
localized/ru/2605
localized/ru/2606
localized/ru/2607
localized/ru/2608
localized/ru/2609
localized/ru/2610
localized/ru/2611
localized/ru/2619
localized/ru/262
localized/ru/2620
localized/ru/264
localized/ru/2673
localized/ru/2697
localized/ru/2698
localized/ru/27
localized/ru/2705
localized/ru/2715
localized/ru/2724
localized/ru/28
localized/ru/2805
localized/ru/2806
localized/ru/2807
localized/ru/2808
localized/ru/2810
localized/ru/2812
localized/ru/2859
localized/ru/3
localized/ru/330
localized/ru/34
localized/ru/35
localized/ru/358
localized/ru/36
localized/ru/361
localized/ru/4
localized/ru/408
localized/ru/5
localized/ru/6
localized/ru/644
localized/ru/645
localized/ru/646
localized/ru/647
localized/ru/649
localized/ru/663
localized/ru/664
localized/ru/665
localized/ru/7
localized/ru/720
localized/ru/739
localized/ru/799
localized/ru/8
localized/ru/800
localized/ru/9
localized/sk/2859
localized/sk/739
localized/sl/2859
localized/sl/739
localized/sr/2859
localized/sr/739
localized/sv/1
localized/sv/10
localized/sv/1068
localized/sv/1069
localized/sv/1070
localized/sv/1071
localized/sv/1076
localized/sv/1077
localized/sv/1078
localized/sv/1080
localized/sv/1093
localized/sv/11
localized/sv/12
localized/sv/13
localized/sv/14
localized/sv/1653
localized/sv/1654
localized/sv/1655
localized/sv/1656
localized/sv/1657
localized/sv/1658
localized/sv/1659
localized/sv/1669
localized/sv/1728
localized/sv/1753
localized/sv/1805
localized/sv/19
localized/sv/2
localized/sv/2222
localized/sv/2223
localized/sv/2224
localized/sv/2225
localized/sv/2226
localized/sv/2227
localized/sv/2228
localized/sv/2229
localized/sv/2230
localized/sv/2231
localized/sv/2232
localized/sv/2266
localized/sv/2291
localized/sv/2292
localized/sv/23
localized/sv/2324
localized/sv/2382
localized/sv/2383
localized/sv/2384
localized/sv/24
localized/sv/254
localized/sv/255
localized/sv/256
localized/sv/257
localized/sv/258
localized/sv/2597
localized/sv/2598
localized/sv/2599
localized/sv/26
localized/sv/2600
localized/sv/2601
localized/sv/2602
localized/sv/2603
localized/sv/2604
localized/sv/2605
localized/sv/2606
localized/sv/2607
localized/sv/2608
localized/sv/2609
localized/sv/2610
localized/sv/2611
localized/sv/2619
localized/sv/262
localized/sv/2620
localized/sv/264
localized/sv/2673
localized/sv/2697
localized/sv/2698
localized/sv/27
localized/sv/2705
localized/sv/2715
localized/sv/2724
localized/sv/28
localized/sv/2805
localized/sv/2806
localized/sv/2807
localized/sv/2808
localized/sv/2810
localized/sv/2812
localized/sv/2859
localized/sv/3
localized/sv/330
localized/sv/34
localized/sv/35
localized/sv/358
localized/sv/36
localized/sv/361
localized/sv/4
localized/sv/408
localized/sv/5
localized/sv/6
localized/sv/644
localized/sv/645
localized/sv/646
localized/sv/647
localized/sv/649
localized/sv/663
localized/sv/664
localized/sv/665
localized/sv/7
localized/sv/720
localized/sv/739
localized/sv/799
localized/sv/8
localized/sv/800
localized/sv/9
localized/th/2859
localized/th/739
localized/tr/1
localized/tr/10
localized/tr/1068
localized/tr/1069
localized/tr/1070
localized/tr/1071
localized/tr/1076
localized/tr/1077
localized/tr/1078
localized/tr/1080
localized/tr/1093
localized/tr/11
localized/tr/12
localized/tr/13
localized/tr/14
localized/tr/1653
localized/tr/1654
localized/tr/1655
localized/tr/1656
localized/tr/1657
localized/tr/1658
localized/tr/1659
localized/tr/1669
localized/tr/1728
localized/tr/1753
localized/tr/1805
localized/tr/19
localized/tr/2
localized/tr/2222
localized/tr/2223
localized/tr/2224
localized/tr/2225
localized/tr/2226
localized/tr/2227
localized/tr/2228
localized/tr/2229
localized/tr/2230
localized/tr/2231
localized/tr/2232
localized/tr/2266
localized/tr/2291
localized/tr/2292
localized/tr/23
localized/tr/2324
localized/tr/2382
localized/tr/2383
localized/tr/2384
localized/tr/24
localized/tr/254
localized/tr/255
localized/tr/256
localized/tr/257
localized/tr/258
localized/tr/2597
localized/tr/2598
localized/tr/2599
localized/tr/26
localized/tr/2600
localized/tr/2601
localized/tr/2602
localized/tr/2603
localized/tr/2604
localized/tr/2605
localized/tr/2606
localized/tr/2607
localized/tr/2608
localized/tr/2609
localized/tr/2610
localized/tr/2611
localized/tr/2619
localized/tr/262
localized/tr/2620
localized/tr/264
localized/tr/2673
localized/tr/2697
localized/tr/2698
localized/tr/27
localized/tr/2705
localized/tr/2715
localized/tr/2724
localized/tr/28
localized/tr/2805
localized/tr/2806
localized/tr/2807
localized/tr/2808
localized/tr/2810
localized/tr/2812
localized/tr/2859
localized/tr/3
localized/tr/330
localized/tr/34
localized/tr/35
localized/tr/358
localized/tr/36
localized/tr/361
localized/tr/4
localized/tr/408
localized/tr/5
localized/tr/6
localized/tr/644
localized/tr/645
localized/tr/646
localized/tr/647
localized/tr/649
localized/tr/663
localized/tr/664
localized/tr/665
localized/tr/7
localized/tr/720
localized/tr/739
localized/tr/799
localized/tr/8
localized/tr/800
localized/tr/9
localized/uk/2859
localized/uk/739
localized/zh-HK/2859
localized/zh-HK/739
localized/zh-cn/1
localized/zh-cn/10
localized/zh-cn/1068
localized/zh-cn/1069
localized/zh-cn/1070
localized/zh-cn/1071
localized/zh-cn/1076
localized/zh-cn/1077
localized/zh-cn/1078
localized/zh-cn/1080
localized/zh-cn/1093
localized/zh-cn/11
localized/zh-cn/12
localized/zh-cn/13
localized/zh-cn/14
localized/zh-cn/1653
localized/zh-cn/1654
localized/zh-cn/1655
localized/zh-cn/1656
localized/zh-cn/1657
localized/zh-cn/1658
localized/zh-cn/1659
localized/zh-cn/1669
localized/zh-cn/1728
localized/zh-cn/1753
localized/zh-cn/1805
localized/zh-cn/19
localized/zh-cn/2
localized/zh-cn/2222
localized/zh-cn/2223
localized/zh-cn/2224
localized/zh-cn/2225
localized/zh-cn/2226
localized/zh-cn/2227
localized/zh-cn/2228
localized/zh-cn/2229
localized/zh-cn/2230
localized/zh-cn/2231
localized/zh-cn/2232
localized/zh-cn/2266
localized/zh-cn/2273
localized/zh-cn/2291
localized/zh-cn/2292
localized/zh-cn/23
localized/zh-cn/2324
localized/zh-cn/2382
localized/zh-cn/2383
localized/zh-cn/2384
localized/zh-cn/24
localized/zh-cn/254
localized/zh-cn/255
localized/zh-cn/256
localized/zh-cn/257
localized/zh-cn/258
localized/zh-cn/2597
localized/zh-cn/2598
localized/zh-cn/2599
localized/zh-cn/26
localized/zh-cn/2600
localized/zh-cn/2601
localized/zh-cn/2602
localized/zh-cn/2603
localized/zh-cn/2604
localized/zh-cn/2605
localized/zh-cn/2606
localized/zh-cn/2607
localized/zh-cn/2608
localized/zh-cn/2609
localized/zh-cn/2610
localized/zh-cn/2611
localized/zh-cn/2619
localized/zh-cn/262
localized/zh-cn/2620
localized/zh-cn/264
localized/zh-cn/2673
localized/zh-cn/2697
localized/zh-cn/2698
localized/zh-cn/27
localized/zh-cn/2705
localized/zh-cn/2715
localized/zh-cn/2724
localized/zh-cn/28
localized/zh-cn/2805
localized/zh-cn/2806
localized/zh-cn/2807
localized/zh-cn/2808
localized/zh-cn/2810
localized/zh-cn/2812
localized/zh-cn/2859
localized/zh-cn/3
localized/zh-cn/330
localized/zh-cn/34
localized/zh-cn/35
localized/zh-cn/358
localized/zh-cn/36
localized/zh-cn/361
localized/zh-cn/4
localized/zh-cn/408
localized/zh-cn/5
localized/zh-cn/6
localized/zh-cn/644
localized/zh-cn/645
localized/zh-cn/646
localized/zh-cn/647
localized/zh-cn/649
localized/zh-cn/663
localized/zh-cn/664
localized/zh-cn/665
localized/zh-cn/7
localized/zh-cn/720
localized/zh-cn/739
localized/zh-cn/799
localized/zh-cn/8
localized/zh-cn/800
localized/zh-cn/9
localized/zh-tw/1
localized/zh-tw/10
localized/zh-tw/1068
localized/zh-tw/1069
localized/zh-tw/1070
localized/zh-tw/1071
localized/zh-tw/1076
localized/zh-tw/1077
localized/zh-tw/1078
localized/zh-tw/1080
localized/zh-tw/1093
localized/zh-tw/11
localized/zh-tw/12
localized/zh-tw/13
localized/zh-tw/14
localized/zh-tw/1653
localized/zh-tw/1654
localized/zh-tw/1655
localized/zh-tw/1656
localized/zh-tw/1657
localized/zh-tw/1658
localized/zh-tw/1659
localized/zh-tw/1669
localized/zh-tw/1728
localized/zh-tw/1753
localized/zh-tw/1805
localized/zh-tw/19
localized/zh-tw/2
localized/zh-tw/2222
localized/zh-tw/2223
localized/zh-tw/2224
localized/zh-tw/2225
localized/zh-tw/2226
localized/zh-tw/2227
localized/zh-tw/2228
localized/zh-tw/2229
localized/zh-tw/2230
localized/zh-tw/2231
localized/zh-tw/2232
localized/zh-tw/2266
localized/zh-tw/2273
localized/zh-tw/2291
localized/zh-tw/2292
localized/zh-tw/23
localized/zh-tw/2324
localized/zh-tw/2382
localized/zh-tw/2383
localized/zh-tw/2384
localized/zh-tw/24
localized/zh-tw/254
localized/zh-tw/255
localized/zh-tw/256
localized/zh-tw/257
localized/zh-tw/258
localized/zh-tw/2597
localized/zh-tw/2598
localized/zh-tw/2599
localized/zh-tw/26
localized/zh-tw/2600
localized/zh-tw/2601
localized/zh-tw/2602
localized/zh-tw/2603
localized/zh-tw/2604
localized/zh-tw/2605
localized/zh-tw/2606
localized/zh-tw/2607
localized/zh-tw/2608
localized/zh-tw/2609
localized/zh-tw/2610
localized/zh-tw/2611
localized/zh-tw/2619
localized/zh-tw/262
localized/zh-tw/2620
localized/zh-tw/264
localized/zh-tw/2673
localized/zh-tw/2697
localized/zh-tw/2698
localized/zh-tw/27
localized/zh-tw/2705
localized/zh-tw/2715
localized/zh-tw/2724
localized/zh-tw/28
localized/zh-tw/2805
localized/zh-tw/2806
localized/zh-tw/2807
localized/zh-tw/2808
localized/zh-tw/2810
localized/zh-tw/2812
localized/zh-tw/2859
localized/zh-tw/3
localized/zh-tw/330
localized/zh-tw/34
localized/zh-tw/35
localized/zh-tw/358
localized/zh-tw/36
localized/zh-tw/361
localized/zh-tw/4
localized/zh-tw/408
localized/zh-tw/5
localized/zh-tw/6
localized/zh-tw/644
localized/zh-tw/645
localized/zh-tw/646
localized/zh-tw/647
localized/zh-tw/649
localized/zh-tw/663
localized/zh-tw/664
localized/zh-tw/665
localized/zh-tw/7
localized/zh-tw/720
localized/zh-tw/739
localized/zh-tw/799
localized/zh-tw/8
localized/zh-tw/800
localized/zh-tw/9
package.xml
Windows6.1-KB3063858-x64-pkgProperties.txt
Windows6.1-KB3063858-x64.cab
.cab
0
1
10
100
101
102
103
104
105
106
107
108
109
11
110
111
112
113
114
115
116
117
118
119
12
120
121
122
123
124
125
126
127
128
129
13
130
131
132
133
134
135
136
137
138
139
14
140
141
142
143
15
16
17
18
19
2
20
21
22
23
24
25
26
27
28
29
3
30
31
32
33
34
35
36
37
38
39
4
40
41
42
43
44
45
46
47
48
49
5
50
51
52
53
54
55
56
57
58
59
6
60
61
62
63
64
65
66
67
68
69
7
70
71
72
73
74
75
76
77
78
79
8
80
81
82
83
84
85
86
87
88
89
9
90
91
92
93
94
95
96
97
98
99
_manifest_.cix.xml
.xml
amd64_239360895b93c9ae9583d01d6cf2cddd_31bf3856ad364e35_6.1.7601.23049_none_3bdc2ad34343a4e7.manifest
.xml
amd64_4a7516f0f534780b2968fbd5996213da_31bf3856ad364e35_6.1.7601.18847_none_563b86f113575238.manifest
.xml
amd64_53b6139a3ef31003f04794994daf74f5_31bf3856ad364e35_6.1.7601.23049_none_bb1bc05fea051fdc.manifest
.xml
amd64_9312ed5430048ba548b3f7fb898ab558_31bf3856ad364e35_6.1.7601.23049_none_ace1a18461f35640.manifest
.xml
amd64_97a66498a0243fafeac68ce247916c91_31bf3856ad364e35_6.1.7601.23049_none_a0bc92645d8b4030.manifest
.xml
amd64_a5ddc9dc59dc06b13ec8f6e42de39319_31bf3856ad364e35_6.1.7601.18847_none_8dd3c92b5a3c987f.manifest
.xml
amd64_a9838b69ace91df928e8baf5c9d7327f_31bf3856ad364e35_6.1.7601.18847_none_4eb059a313ccca6e.manifest
.xml
amd64_b7c3f2d9fc33c600b1a1699e123cca31_31bf3856ad364e35_6.1.7601.18847_none_b66ee59592fdff2f.manifest
.xml
amd64_c20d48da49a67c83c7cf7c1f54681ee7_31bf3856ad364e35_6.1.7601.23049_none_2f348033cca641ee.manifest
.xml
amd64_eb7344ee1973331da77f35ed87d8f46f_31bf3856ad364e35_6.1.7601.23049_none_4383855cd0fca5f9.manifest
.xml
amd64_eec97f5c6a93a097994361fbb3adf939_31bf3856ad364e35_6.1.7601.18847_none_ecc69e0d72b50b76.manifest
.xml
amd64_f22ed99d27b62fc1881d44b33301bde0_31bf3856ad364e35_6.1.7601.18847_none_851dbb01f2cb42e6.manifest
.xml
amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.18847_none_d2644cc418cf00e2.manifest
.xml
amd64_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.23049_none_d2efc24531eb069c.manifest
.xml
amd64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.18847_none_f1c66ab46d00c3dd.manifest
.xml
amd64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.23049_none_f251e035861cc997.manifest
.xml
amd64_microsoft-windows-kernelbase_31bf3856ad364e35_6.1.7601.18847_none_850afdc6cb494bc9.manifest
.xml
amd64_microsoft-windows-kernelbase_31bf3856ad364e35_6.1.7601.23049_none_85967347e4655183.manifest
.xml
amd64_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_6.1.7601.18847_none_68ba756992852e6b.manifest
.xml
amd64_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_6.1.7601.23049_none_6945eaeaaba13425.manifest
.xml
amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18847_none_14871c15b30a70da.manifest
.xml
amd64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23049_none_15129196cc267694.manifest
.xml
amd64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.18847_none_c62e4d7cee046cf8.manifest
.xml
amd64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.23049_none_c6b9c2fe072072b2.manifest
.xml
package_1_for_kb3063858_bf~31bf3856ad364e35~amd64~~6.1.1.0.cat
package_1_for_kb3063858_bf~31bf3856ad364e35~amd64~~6.1.1.0.mum
.xml
package_1_for_kb3063858~31bf3856ad364e35~amd64~~6.1.1.0.cat
package_1_for_kb3063858~31bf3856ad364e35~amd64~~6.1.1.0.mum
.xml
package_2_for_kb3063858_bf~31bf3856ad364e35~amd64~~6.1.1.0.cat
package_2_for_kb3063858_bf~31bf3856ad364e35~amd64~~6.1.1.0.mum
.xml
package_2_for_kb3063858~31bf3856ad364e35~amd64~~6.1.1.0.cat
package_2_for_kb3063858~31bf3856ad364e35~amd64~~6.1.1.0.mum
.xml
package_3_for_kb3063858_bf~31bf3856ad364e35~amd64~~6.1.1.0.cat
package_3_for_kb3063858_bf~31bf3856ad364e35~amd64~~6.1.1.0.mum
.xml
package_3_for_kb3063858~31bf3856ad364e35~amd64~~6.1.1.0.cat
package_3_for_kb3063858~31bf3856ad364e35~amd64~~6.1.1.0.mum
.xml
package_4_for_kb3063858_bf~31bf3856ad364e35~amd64~~6.1.1.0.cat
package_4_for_kb3063858_bf~31bf3856ad364e35~amd64~~6.1.1.0.mum
.xml
package_4_for_kb3063858~31bf3856ad364e35~amd64~~6.1.1.0.cat
package_4_for_kb3063858~31bf3856ad364e35~amd64~~6.1.1.0.mum
.xml
package_5_for_kb3063858_bf~31bf3856ad364e35~amd64~~6.1.1.0.cat
package_5_for_kb3063858_bf~31bf3856ad364e35~amd64~~6.1.1.0.mum
.xml
package_5_for_kb3063858~31bf3856ad364e35~amd64~~6.1.1.0.cat
package_5_for_kb3063858~31bf3856ad364e35~amd64~~6.1.1.0.mum
.xml
package_6_for_kb3063858_bf~31bf3856ad364e35~amd64~~6.1.1.0.cat
package_6_for_kb3063858_bf~31bf3856ad364e35~amd64~~6.1.1.0.mum
.xml
package_6_for_kb3063858~31bf3856ad364e35~amd64~~6.1.1.0.cat
package_6_for_kb3063858~31bf3856ad364e35~amd64~~6.1.1.0.mum
.xml
package_for_kb3063858_rtm_bf~31bf3856ad364e35~amd64~~6.1.1.0.cat
package_for_kb3063858_rtm_bf~31bf3856ad364e35~amd64~~6.1.1.0.mum
.xml
package_for_kb3063858_rtm~31bf3856ad364e35~amd64~~6.1.1.0.cat
package_for_kb3063858_rtm~31bf3856ad364e35~amd64~~6.1.1.0.mum
.xml
package_for_kb3063858_sp1_bf~31bf3856ad364e35~amd64~~6.1.1.0.cat
package_for_kb3063858_sp1_bf~31bf3856ad364e35~amd64~~6.1.1.0.mum
.xml
package_for_kb3063858_sp1~31bf3856ad364e35~amd64~~6.1.1.0.cat
package_for_kb3063858_sp1~31bf3856ad364e35~amd64~~6.1.1.0.mum
.xml
update-bf.cat
update-bf.mum
.xml
update.cat
update.mum
wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.18847_none_fc1b1506a16185d8.manifest
.xml
wow64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.23049_none_fca68a87ba7d8b92.manifest
.xml
wow64_microsoft-windows-kernelbase_31bf3856ad364e35_6.1.7601.18847_none_8f5fa818ffaa0dc4.manifest
.xml
wow64_microsoft-windows-kernelbase_31bf3856ad364e35_6.1.7601.23049_none_8feb1d9a18c6137e.manifest
.xml
wow64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18847_none_1edbc667e76b32d5.manifest
.xml
wow64_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23049_none_1f673be90087388f.manifest
.xml
wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.18847_none_d082f7cf22652ef3.manifest
.xml
wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7601.23049_none_d10e6d503b8134ad.manifest
.xml
x86_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_6.1.7601.18847_none_0c9bd9e5da27bd35.manifest
.xml
x86_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_6.1.7601.23049_none_0d274f66f343c2ef.manifest
.xml
Windows6.1-KB3063858-x64.xml
.xml
plugins/windows_updates/Windows6.1-KB3063858-x86.msu
.cab
WSUSSCAN.cab
.cab
package.cab
.cab
core/1
core/10
core/105
core/1068
core/1069
core/1070
core/1071
core/1076
core/1077
core/1078
core/1079
core/1080
core/1081
core/1082
core/1083
core/1085
core/1086
core/1088
core/1093
core/1094
core/1095
core/1096
core/1098
core/1099
core/11
core/1100
core/1101
core/1102
core/1103
core/1104
core/1105
core/1106
core/1107
core/1108
core/1109
core/111
core/1110
core/1111
core/1112
core/1113
core/1117
core/1122
core/1124
core/1131
core/1136
core/1142
core/1143
core/1144
core/1146
core/1147
core/1149
core/115
core/1150
core/1152
core/1153
core/1154
core/1155
core/1156
core/1157
core/1158
core/1159
core/116
core/1160
core/1161
core/1162
core/1163
core/1164
core/1165
core/1166
core/117
core/1174
core/1175
core/118
core/119
core/12
core/120
core/1203
core/121
core/122
core/1227
core/123
core/1231
core/1233
core/1236
core/124
core/1240
core/1246
core/125
core/126
core/1270
core/1271
core/1272
core/1274
core/1276
core/1279
core/13
core/1307
core/1308
core/1337
core/1338
core/1346
core/14
core/15
core/16
core/1653
core/1654
core/1655
core/1656
core/1657
core/1658
core/1659
core/1660
core/1661
core/1662
core/1663
core/1664
core/1665
core/1666
core/1668
core/1669
core/1670
core/1671
core/1672
core/1678
core/1679
core/1682
core/1683
core/1684
core/1685
core/1686
core/1687
core/1688
core/1689
core/1690
core/1691
core/1692
core/1693
core/1694
core/1695
core/1696
core/1697
core/1698
core/1699
core/17
core/1700
core/1701
core/1703
core/1711
core/1717
core/1718
core/1723
core/1724
core/1725
core/1726
core/1727
core/1728
core/1730
core/1731
core/1732
core/1733
core/1734
core/1735
core/1736
core/1737
core/1738
core/1739
core/1740
core/1741
core/1742
core/1743
core/1744
core/1745
core/1746
core/1747
core/1748
core/1749
core/1750
core/1751
core/1753
core/1759
core/1771
core/1774
core/1781
core/1790
core/18
core/1805
core/1817
core/1822
core/1823
core/1824
core/1825
core/1829
core/1831
core/1843
core/1859
core/1860
core/1861
core/1864
core/1866
core/1869
core/1884
core/1885
core/1890
core/1891
core/19
core/1910
core/1911
core/1913
core/1928
core/1935
core/1952
core/1953
core/1956
core/1957
core/1958
core/1982
core/2
core/20
core/2008
core/21
core/22
core/2222
core/2223
core/2224
core/2225
core/2226
core/2227
core/2228
core/2229
core/2230
core/2231
core/2232
core/2233
core/2234
core/2235
core/2236
core/2237
core/2238
core/2239
core/2240
core/2241
core/2242
core/2243
core/2244
core/2245
core/2246
core/2247
core/2248
core/2249
core/2250
core/2251
core/2252
core/2253
core/2254
core/2255
core/2256
core/2257
core/2258
core/2259
core/2260
core/2261
core/2262
core/2263
core/2264
core/2265
core/2266
core/2267
core/2268
core/2269
core/2272
core/2273
core/2274
core/2275
core/2284
core/2285
core/2287
core/2288
core/2289
core/2290
core/2291
core/2292
core/2293
core/2294
core/2295
core/2296
core/2297
core/2298
core/2299
core/23
core/2300
core/2301
core/2302
core/2303
core/2304
core/2305
core/2306
core/2307
core/2308
core/2309
core/2310
core/2311
core/2312
core/2313
core/2314
core/2315
core/2316
core/2317
core/2318
core/2320
core/2321
core/2324
core/2325
core/2340
core/2341
core/2342
core/2345
core/2346
core/2347
core/2348
core/2349
core/2350
core/2360
core/2361
core/2364
core/2365
core/2366
core/2367
core/2369
core/2371
core/2373
core/2382
core/2383
core/2384
core/2386
core/2389
core/2390
core/2392
core/2393
core/2394
core/2396
core/2397
core/2398
core/24
core/2404
core/2406
core/2407
core/2408
core/2409
core/2410
core/2411
core/2413
core/2414
core/2415
core/2416
core/2417
core/2418
core/2419
core/2420
core/2425
core/2426
core/2427
core/2428
core/2429
core/2430
core/2431
core/2432
core/2441
core/2442
core/2443
core/2444
core/2445
core/2446
core/2447
core/2448
core/2449
core/2457
core/2470
core/2477
core/2481
core/2482
core/25
core/254
core/255
core/256
core/257
core/258
core/2597
core/2598
core/2599
core/26
core/2600
core/2601
core/2602
core/2603
core/2604
core/2605
core/2606
core/2607
core/2608
core/2609
core/2610
core/2611
core/2612
core/2613
core/2614
core/2615
core/2616
core/2617
core/2618
core/2619
core/262
core/2620
core/2621
core/2622
core/2623
core/2624
core/2625
core/2626
core/2627
core/2628
core/2629
core/263
core/2630
core/2631
core/2632
core/2633
core/2634
core/2635
core/2636
core/2637
core/2638
core/2639
core/264
core/2640
core/2641
core/2642
core/2643
core/2644
core/2645
core/2648
core/2649
core/265
core/2650
core/2651
core/2652
core/2653
core/2654
core/2655
core/2656
core/2657
core/2658
core/2659
core/266
core/2660
core/2661
core/2662
core/2663
core/2664
core/2665
core/2667
core/2669
core/267
core/2670
core/2671
core/2672
core/2673
core/2674
core/2675
core/2676
core/2677
core/2678
core/2679
core/268
core/2680
core/2681
core/2682
core/2683
core/2684
core/2685
core/2686
core/2687
core/2689
core/269
core/2690
core/2691
core/2692
core/2693
core/2694
core/2695
core/2696
core/2697
core/2698
core/2699
core/27
core/2700
core/2705
core/2706
core/2707
core/2708
core/2709
core/2710
core/2714
core/2715
core/2716
core/2718
core/2721
core/2723
core/2724
core/2725
core/2727
core/2728
core/2729
core/2730
core/2735
core/2736
core/2737
core/274
core/2740
core/2741
core/2743
core/2747
core/2748
core/275
core/2755
core/2756
core/2758
core/2759
core/2762
core/2763
core/2766
core/28
core/2805
core/2806
core/2807
core/2808
core/2809
core/2810
core/2811
core/2812
core/2813
core/2814
core/2815
core/2816
core/2817
core/2818
core/2819
core/2820
core/2821
core/2822
core/2823
core/2824
core/2825
core/2826
core/2827
core/2828
core/2829
core/2830
core/2831
core/2832
core/2833
core/2834
core/2835
core/2837
core/2838
core/2839
core/2840
core/2841
core/2842
core/2843
core/2844
core/2845
core/2846
core/2847
core/2848
core/2849
core/2850
core/2851
core/2852
core/2853
core/2854
core/2855
core/2856
core/2857
core/2858
core/2859
core/286
core/287
core/288
core/289
core/290
core/291
core/292
core/293
core/294
core/295
core/296
core/297
core/298
core/299
core/3
core/300
core/301
core/302
core/303
core/304
core/305
core/306
core/309
core/310
core/324
core/327
core/330
core/331
core/333
core/334
core/335
core/336
core/337
core/338
core/339
core/34
core/340
core/341
core/342
core/343
core/344
core/345
core/346
core/347
core/349
core/35
core/350
core/351
core/352
core/358
core/36
core/361
core/37
core/384
core/385
core/386
core/387
core/4
core/406
core/408
core/41
core/43
core/44
core/46
core/47
core/5
core/6
core/644
core/645
core/646
core/647
core/649
core/65
core/651
core/652
core/653
core/66
core/660
core/661
core/662
core/663
core/664
core/665
core/666
core/669
core/67
core/673
core/674
core/675
core/676
core/677
core/678
core/679
core/68
core/680
core/681
core/682
core/683
core/684
core/685
core/686
core/687
core/688
core/69
core/690
core/692
core/693
core/696
core/697
core/7
core/70
core/701
core/702
core/704
core/705
core/71
core/716
core/717
core/718
core/719
core/72
core/720
core/721
core/724
core/725
core/726
core/727
core/728
core/729
core/73
core/730
core/731
core/732
core/733
core/734
core/735
core/737
core/739
core/740
core/741
core/743
core/754
core/755
core/756
core/757
core/758
core/759
core/760
core/761
core/762
core/763
core/764
core/765
core/766
core/767
core/768
core/771
core/781
core/782
core/790
core/797
core/798
core/799
core/8
core/800
core/812
core/813
core/814
core/815
core/816
core/82
core/829
core/830
core/831
core/832
core/833
core/89
core/9
core/90
core/92
extended/1
extended/10
extended/105
extended/1068
extended/1069
extended/1070
extended/1071
extended/1076
extended/1077
extended/1078
extended/1079
extended/1080
extended/1081
extended/1082
extended/1083
extended/1085
extended/1086
extended/1088
extended/1093
extended/1094
extended/1095
extended/1096
extended/1098
extended/1099
extended/11
extended/1100
extended/1101
extended/1102
extended/1103
extended/1104
extended/1105
extended/1106
extended/1107
extended/1108
extended/1109
extended/111
extended/1110
extended/1111
extended/1112
extended/1113
extended/1117
extended/1122
extended/1124
extended/1131
extended/1136
extended/1142
extended/1143
extended/1144
extended/1146
extended/1147
extended/1149
extended/115
extended/1150
extended/1152
extended/1153
extended/1154
extended/1155
extended/1156
extended/1157
extended/1158
extended/1159
extended/116
extended/1160
extended/1161
extended/1162
extended/1163
extended/1164
extended/1165
extended/1166
extended/117
extended/1174
extended/1175
extended/118
extended/119
extended/12
extended/120
extended/1203
extended/121
extended/122
extended/1227
extended/123
extended/1231
extended/1233
extended/1236
extended/124
extended/1240
extended/1246
extended/125
extended/126
extended/1270
extended/1271
extended/1272
extended/1274
extended/1276
extended/1279
extended/13
extended/1307
extended/1308
extended/1337
extended/1338
extended/1346
extended/14
extended/15
extended/16
extended/1653
extended/1654
extended/1655
extended/1656
extended/1657
extended/1658
extended/1659
extended/1660
extended/1661
extended/1662
extended/1663
extended/1664
extended/1665
extended/1666
extended/1668
extended/1669
extended/1670
extended/1671
extended/1672
extended/1678
extended/1679
extended/1682
extended/1683
extended/1684
extended/1685
extended/1686
extended/1687
extended/1688
extended/1689
extended/1690
extended/1691
extended/1692
extended/1693
extended/1694
extended/1695
extended/1696
extended/1697
extended/1698
extended/1699
extended/17
extended/1700
extended/1701
extended/1703
extended/1711
extended/1717
extended/1718
extended/1723
extended/1724
extended/1725
extended/1726
extended/1727
extended/1728
extended/1730
extended/1731
extended/1732
extended/1733
extended/1734
extended/1735
extended/1736
extended/1737
extended/1738
extended/1739
extended/1740
extended/1741
extended/1742
extended/1743
extended/1744
extended/1745
extended/1746
extended/1747
extended/1748
extended/1749
extended/1750
extended/1751
extended/1753
extended/1759
extended/1771
extended/1774
extended/1781
extended/1790
extended/18
extended/1805
extended/1817
extended/1822
extended/1823
extended/1824
extended/1825
extended/1829
extended/1831
extended/1843
extended/1859
extended/1860
extended/1861
extended/1864
extended/1866
extended/1869
extended/1884
extended/1885
extended/1890
extended/1891
extended/19
extended/1910
extended/1911
extended/1913
extended/1928
extended/1935
extended/1952
extended/1953
extended/1956
extended/1957
extended/1958
extended/1982
extended/2
extended/20
extended/2008
extended/21
extended/22
extended/2222
extended/2223
extended/2224
extended/2225
extended/2226
extended/2227
extended/2228
extended/2229
extended/2230
extended/2231
extended/2232
extended/2233
extended/2234
extended/2235
extended/2236
extended/2237
extended/2238
extended/2239
extended/2240
extended/2241
extended/2242
extended/2243
extended/2244
extended/2245
extended/2246
extended/2247
extended/2248
extended/2249
extended/2250
extended/2251
extended/2252
extended/2253
extended/2254
extended/2255
extended/2256
extended/2257
extended/2258
extended/2259
extended/2260
extended/2261
extended/2262
extended/2263
extended/2264
extended/2265
extended/2266
extended/2267
extended/2268
extended/2269
extended/2272
extended/2273
extended/2274
extended/2275
extended/2284
extended/2285
extended/2287
extended/2288
extended/2289
extended/2290
extended/2291
extended/2292
extended/2293
extended/2294
extended/2295
extended/2296
extended/2297
extended/2298
extended/2299
extended/23
extended/2300
extended/2301
extended/2302
extended/2303
extended/2304
extended/2305
extended/2306
extended/2307
extended/2308
extended/2309
extended/2310
extended/2311
extended/2312
extended/2313
extended/2314
extended/2315
extended/2316
extended/2317
extended/2318
extended/2320
extended/2321
extended/2324
extended/2325
extended/2340
extended/2341
extended/2342
extended/2345
extended/2346
extended/2347
extended/2348
extended/2349
extended/2350
extended/2360
extended/2361
extended/2364
extended/2365
extended/2366
extended/2367
extended/2369
extended/2371
extended/2373
extended/2382
extended/2383
extended/2384
extended/2386
extended/2389
extended/2390
extended/2392
extended/2393
extended/2394
extended/2396
extended/2397
extended/2398
extended/24
extended/2404
extended/2406
extended/2407
extended/2408
extended/2409
extended/2410
extended/2411
extended/2413
extended/2414
extended/2415
extended/2416
extended/2417
extended/2418
extended/2419
extended/2420
extended/2425
extended/2426
extended/2427
extended/2428
extended/2429
extended/2430
extended/2431
extended/2432
extended/2441
extended/2442
extended/2443
extended/2444
extended/2445
extended/2446
extended/2447
extended/2448
extended/2449
extended/2457
extended/2470
extended/2477
extended/2481
extended/2482
extended/25
extended/254
extended/255
extended/256
extended/257
extended/258
extended/2597
extended/2598
extended/2599
extended/26
extended/2600
extended/2601
extended/2602
extended/2603
extended/2604
extended/2605
extended/2606
extended/2607
extended/2608
extended/2609
extended/2610
extended/2611
extended/2612
extended/2613
extended/2614
extended/2615
extended/2616
extended/2617
extended/2618
extended/2619
extended/262
extended/2620
extended/2621
extended/2622
extended/2623
extended/2624
extended/2625
extended/2626
extended/2627
extended/2628
extended/2629
extended/263
extended/2630
extended/2631
extended/2632
extended/2633
extended/2634
extended/2635
extended/2636
extended/2637
extended/2638
extended/2639
extended/264
extended/2640
extended/2641
extended/2642
extended/2643
extended/2644
extended/2645
extended/2648
extended/2649
extended/265
extended/2650
extended/2651
extended/2652
extended/2653
extended/2654
extended/2655
extended/2656
extended/2657
extended/2658
extended/2659
extended/266
extended/2660
extended/2661
extended/2662
extended/2663
extended/2664
extended/2665
extended/2667
extended/2669
extended/267
extended/2670
extended/2671
extended/2672
extended/2673
extended/2674
extended/2675
extended/2676
extended/2677
extended/2678
extended/2679
extended/268
extended/2680
extended/2681
extended/2682
extended/2683
extended/2684
extended/2685
extended/2686
extended/2687
extended/2689
extended/269
extended/2690
extended/2691
extended/2692
extended/2693
extended/2694
extended/2695
extended/2696
extended/2697
extended/2698
extended/2699
extended/27
extended/2700
extended/2705
extended/2706
extended/2707
extended/2708
extended/2709
extended/2710
extended/2714
extended/2715
extended/2716
extended/2718
extended/2721
extended/2723
extended/2724
extended/2725
extended/2727
extended/2728
extended/2729
extended/2730
extended/2735
extended/2736
extended/2737
extended/274
extended/2740
extended/2741
extended/2743
extended/2747
extended/2748
extended/275
extended/2755
extended/2756
extended/2758
extended/2759
extended/2762
extended/2763
extended/2766
extended/28
extended/2805
extended/2806
extended/2807
extended/2808
extended/2809
extended/2810
extended/2811
extended/2812
extended/2813
extended/2814
extended/2815
extended/2816
extended/2817
extended/2818
extended/2819
extended/2820
extended/2821
extended/2822
extended/2823
extended/2824
extended/2825
extended/2826
extended/2827
extended/2828
extended/2829
extended/2830
extended/2831
extended/2832
extended/2833
extended/2834
extended/2835
extended/2837
extended/2838
extended/2839
extended/2840
extended/2841
extended/2842
extended/2843
extended/2844
extended/2845
extended/2846
extended/2847
extended/2848
extended/2849
extended/2850
extended/2851
extended/2852
extended/2853
extended/2854
extended/2855
extended/2856
extended/2857
extended/2858
extended/2859
extended/286
extended/287
extended/288
extended/289
extended/290
extended/291
extended/292
extended/293
extended/294
extended/295
extended/296
extended/297
extended/298
extended/299
extended/3
extended/300
extended/301
extended/302
extended/303
extended/304
extended/305
extended/306
extended/309
extended/310
extended/324
extended/327
extended/330
extended/331
extended/333
extended/334
extended/335
extended/336
extended/337
extended/338
extended/339
extended/34
extended/340
extended/341
extended/342
extended/343
extended/344
extended/345
extended/346
extended/347
extended/349
extended/35
extended/350
extended/351
extended/352
extended/358
extended/36
extended/361
extended/37
extended/384
extended/385
extended/386
extended/387
extended/4
extended/406
extended/408
extended/41
extended/43
extended/44
extended/46
extended/47
extended/5
extended/6
extended/644
extended/645
extended/646
extended/647
extended/649
extended/65
extended/651
extended/652
extended/653
extended/66
extended/660
extended/661
extended/662
extended/663
extended/664
extended/665
extended/666
extended/669
extended/67
extended/673
extended/674
extended/675
extended/676
extended/677
extended/678
extended/679
extended/68
extended/680
extended/681
extended/682
extended/683
extended/684
extended/685
extended/686
extended/687
extended/688
extended/69
extended/690
extended/692
extended/693
extended/696
extended/697
extended/7
extended/70
extended/701
extended/702
extended/704
extended/705
extended/71
extended/716
extended/717
extended/718
extended/719
extended/72
extended/720
extended/721
extended/724
extended/725
extended/726
extended/727
extended/728
extended/729
extended/73
extended/730
extended/731
extended/732
extended/733
extended/734
extended/735
extended/737
extended/739
extended/740
extended/741
extended/743
extended/754
extended/755
extended/756
extended/757
extended/758
extended/759
extended/760
extended/761
extended/762
extended/763
extended/764
extended/765
extended/766
extended/767
extended/768
extended/771
extended/781
extended/782
extended/790
extended/797
extended/798
extended/799
extended/8
extended/800
extended/812
extended/813
extended/814
extended/815
extended/816
extended/82
extended/829
extended/830
extended/831
extended/832
extended/833
extended/89
extended/9
extended/90
extended/92
localized/ar/1
localized/ar/10
localized/ar/1068
localized/ar/1069
localized/ar/1070
localized/ar/1071
localized/ar/1076
localized/ar/1077
localized/ar/1078
localized/ar/1080
localized/ar/1093
localized/ar/11
localized/ar/12
localized/ar/13
localized/ar/14
localized/ar/1653
localized/ar/1654
localized/ar/1655
localized/ar/1656
localized/ar/1657
localized/ar/1658
localized/ar/1659
localized/ar/1669
localized/ar/1728
localized/ar/1753
localized/ar/1805
localized/ar/19
localized/ar/2
localized/ar/2222
localized/ar/2223
localized/ar/2224
localized/ar/2225
localized/ar/2226
localized/ar/2227
localized/ar/2228
localized/ar/2229
localized/ar/2230
localized/ar/2231
localized/ar/2232
localized/ar/2266
localized/ar/2291
localized/ar/2292
localized/ar/23
localized/ar/2324
localized/ar/2382
localized/ar/2383
localized/ar/2384
localized/ar/24
localized/ar/254
localized/ar/255
localized/ar/256
localized/ar/257
localized/ar/258
localized/ar/2597
localized/ar/2598
localized/ar/2599
localized/ar/26
localized/ar/2600
localized/ar/2601
localized/ar/2602
localized/ar/2603
localized/ar/2604
localized/ar/2605
localized/ar/2606
localized/ar/2607
localized/ar/2608
localized/ar/2609
localized/ar/2610
localized/ar/2611
localized/ar/2619
localized/ar/262
localized/ar/2620
localized/ar/264
localized/ar/2673
localized/ar/2697
localized/ar/2698
localized/ar/27
localized/ar/2705
localized/ar/2715
localized/ar/2724
localized/ar/28
localized/ar/2805
localized/ar/2806
localized/ar/2807
localized/ar/2808
localized/ar/2810
localized/ar/2812
localized/ar/2859
localized/ar/3
localized/ar/330
localized/ar/34
localized/ar/35
localized/ar/358
localized/ar/36
localized/ar/361
localized/ar/4
localized/ar/408
localized/ar/5
localized/ar/6
localized/ar/644
localized/ar/645
localized/ar/646
localized/ar/647
localized/ar/649
localized/ar/663
localized/ar/664
localized/ar/665
localized/ar/7
localized/ar/720
localized/ar/739
localized/ar/799
localized/ar/8
localized/ar/800
localized/ar/9
localized/bg/2859
localized/bg/739
localized/cs/1
localized/cs/10
localized/cs/1068
localized/cs/1069
localized/cs/1070
localized/cs/1071
localized/cs/1076
localized/cs/1077
localized/cs/1078
localized/cs/1080
localized/cs/1093
localized/cs/11
localized/cs/12
localized/cs/13
localized/cs/14
localized/cs/1653
localized/cs/1654
localized/cs/1655
localized/cs/1656
localized/cs/1657
localized/cs/1658
localized/cs/1659
localized/cs/1669
localized/cs/1728
localized/cs/1753
localized/cs/1805
localized/cs/19
localized/cs/2
localized/cs/2222
localized/cs/2223
localized/cs/2224
localized/cs/2225
localized/cs/2226
localized/cs/2227
localized/cs/2228
localized/cs/2229
localized/cs/2230
localized/cs/2231
localized/cs/2232
localized/cs/2266
localized/cs/2291
localized/cs/2292
localized/cs/23
localized/cs/2324
localized/cs/2382
localized/cs/2383
localized/cs/2384
localized/cs/24
localized/cs/254
localized/cs/255
localized/cs/256
localized/cs/257
localized/cs/258
localized/cs/2597
localized/cs/2598
localized/cs/2599
localized/cs/26
localized/cs/2600
localized/cs/2601
localized/cs/2602
localized/cs/2603
localized/cs/2604
localized/cs/2605
localized/cs/2606
localized/cs/2607
localized/cs/2608
localized/cs/2609
localized/cs/2610
localized/cs/2611
localized/cs/2619
localized/cs/262
localized/cs/2620
localized/cs/264
localized/cs/2673
localized/cs/2697
localized/cs/2698
localized/cs/27
localized/cs/2705
localized/cs/2715
localized/cs/2724
localized/cs/28
localized/cs/2805
localized/cs/2806
localized/cs/2807
localized/cs/2808
localized/cs/2810
localized/cs/2812
localized/cs/2859
localized/cs/3
localized/cs/330
localized/cs/34
localized/cs/35
localized/cs/358
localized/cs/36
localized/cs/361
localized/cs/4
localized/cs/408
localized/cs/5
localized/cs/6
localized/cs/644
localized/cs/645
localized/cs/646
localized/cs/647
localized/cs/649
localized/cs/663
localized/cs/664
localized/cs/665
localized/cs/7
localized/cs/720
localized/cs/739
localized/cs/799
localized/cs/8
localized/cs/800
localized/cs/9
localized/da/1
localized/da/10
localized/da/1068
localized/da/1069
localized/da/1070
localized/da/1071
localized/da/1076
localized/da/1077
localized/da/1078
localized/da/1080
localized/da/1093
localized/da/11
localized/da/12
localized/da/13
localized/da/14
localized/da/1653
localized/da/1654
localized/da/1655
localized/da/1656
localized/da/1657
localized/da/1658
localized/da/1659
localized/da/1669
localized/da/1728
localized/da/1753
localized/da/1805
localized/da/19
localized/da/2
localized/da/2222
localized/da/2223
localized/da/2224
localized/da/2225
localized/da/2226
localized/da/2227
localized/da/2228
localized/da/2229
localized/da/2230
localized/da/2231
localized/da/2232
localized/da/2266
localized/da/2291
localized/da/2292
localized/da/23
localized/da/2324
localized/da/2382
localized/da/2383
localized/da/2384
localized/da/24
localized/da/254
localized/da/255
localized/da/256
localized/da/257
localized/da/258
localized/da/2597
localized/da/2598
localized/da/2599
localized/da/26
localized/da/2600
localized/da/2601
localized/da/2602
localized/da/2603
localized/da/2604
localized/da/2605
localized/da/2606
localized/da/2607
localized/da/2608
localized/da/2609
localized/da/2610
localized/da/2611
localized/da/2619
localized/da/262
localized/da/2620
localized/da/264
localized/da/2673
localized/da/2697
localized/da/2698
localized/da/27
localized/da/2705
localized/da/2715
localized/da/2724
localized/da/28
localized/da/2805
localized/da/2806
localized/da/2807
localized/da/2808
localized/da/2810
localized/da/2812
localized/da/2859
localized/da/3
localized/da/330
localized/da/34
localized/da/35
localized/da/358
localized/da/36
localized/da/361
localized/da/4
localized/da/408
localized/da/5
localized/da/6
localized/da/644
localized/da/645
localized/da/646
localized/da/647
localized/da/649
localized/da/663
localized/da/664
localized/da/665
localized/da/7
localized/da/720
localized/da/739
localized/da/799
localized/da/8
localized/da/800
localized/da/9
localized/de/1
localized/de/10
localized/de/1068
localized/de/1069
localized/de/1070
localized/de/1071
localized/de/1076
localized/de/1077
localized/de/1078
localized/de/1080
localized/de/1093
localized/de/11
localized/de/12
localized/de/13
localized/de/14
localized/de/1653
localized/de/1654
localized/de/1655
localized/de/1656
localized/de/1657
localized/de/1658
localized/de/1659
localized/de/1669
localized/de/1728
localized/de/1753
localized/de/1805
localized/de/19
localized/de/2
localized/de/2222
localized/de/2223
localized/de/2224
localized/de/2225
localized/de/2226
localized/de/2227
localized/de/2228
localized/de/2229
localized/de/2230
localized/de/2231
localized/de/2232
localized/de/2266
localized/de/2273
localized/de/2291
localized/de/2292
localized/de/23
localized/de/2324
localized/de/2382
localized/de/2383
localized/de/2384
localized/de/24
localized/de/254
localized/de/255
localized/de/256
localized/de/257
localized/de/258
localized/de/2597
localized/de/2598
localized/de/2599
localized/de/26
localized/de/2600
localized/de/2601
localized/de/2602
localized/de/2603
localized/de/2604
localized/de/2605
localized/de/2606
localized/de/2607
localized/de/2608
localized/de/2609
localized/de/2610
localized/de/2611
localized/de/2619
localized/de/262
localized/de/2620
localized/de/264
localized/de/2673
localized/de/2697
localized/de/2698
localized/de/27
localized/de/2705
localized/de/2715
localized/de/2724
localized/de/28
localized/de/2805
localized/de/2806
localized/de/2807
localized/de/2808
localized/de/2810
localized/de/2812
localized/de/2859
localized/de/3
localized/de/330
localized/de/34
localized/de/35
localized/de/358
localized/de/36
localized/de/361
localized/de/4
localized/de/408
localized/de/5
localized/de/6
localized/de/644
localized/de/645
localized/de/646
localized/de/647
localized/de/649
localized/de/663
localized/de/664
localized/de/665
localized/de/7
localized/de/720
localized/de/739
localized/de/799
localized/de/8
localized/de/800
localized/de/9
localized/el/1
localized/el/10
localized/el/1068
localized/el/1069
localized/el/1070
localized/el/1071
localized/el/1076
localized/el/1077
localized/el/1078
localized/el/1080
localized/el/1093
localized/el/11
localized/el/12
localized/el/13
localized/el/14
localized/el/1653
localized/el/1654
localized/el/1655
localized/el/1656
localized/el/1657
localized/el/1658
localized/el/1659
localized/el/1669
localized/el/1728
localized/el/1753
localized/el/1805
localized/el/19
localized/el/2
localized/el/2222
localized/el/2223
localized/el/2224
localized/el/2225
localized/el/2226
localized/el/2227
localized/el/2228
localized/el/2229
localized/el/2230
localized/el/2231
localized/el/2232
localized/el/2266
localized/el/2291
localized/el/2292
localized/el/23
localized/el/2324
localized/el/2382
localized/el/2383
localized/el/2384
localized/el/24
localized/el/254
localized/el/255
localized/el/256
localized/el/257
localized/el/258
localized/el/2597
localized/el/2598
localized/el/2599
localized/el/26
localized/el/2600
localized/el/2601
localized/el/2602
localized/el/2603
localized/el/2604
localized/el/2605
localized/el/2606
localized/el/2607
localized/el/2608
localized/el/2609
localized/el/2610
localized/el/2611
localized/el/2619
localized/el/262
localized/el/2620
localized/el/264
localized/el/2673
localized/el/2697
localized/el/2698
localized/el/27
localized/el/2705
localized/el/2715
localized/el/2724
localized/el/28
localized/el/2805
localized/el/2806
localized/el/2807
localized/el/2808
localized/el/2810
localized/el/2812
localized/el/2859
localized/el/3
localized/el/330
localized/el/34
localized/el/35
localized/el/358
localized/el/36
localized/el/361
localized/el/4
localized/el/408
localized/el/5
localized/el/6
localized/el/644
localized/el/645
localized/el/646
localized/el/647
localized/el/649
localized/el/663
localized/el/664
localized/el/665
localized/el/7
localized/el/720
localized/el/739
localized/el/799
localized/el/8
localized/el/800
localized/el/9
localized/en/1
localized/en/10
localized/en/105
localized/en/1068
localized/en/1069
localized/en/1070
localized/en/1071
localized/en/1076
localized/en/1077
localized/en/1078
localized/en/1079
localized/en/1080
localized/en/1081
localized/en/1082
localized/en/1083
localized/en/1085
localized/en/1086
localized/en/1088
localized/en/1093
localized/en/1094
localized/en/1095
localized/en/1096
localized/en/1098
localized/en/1099
localized/en/11
localized/en/1100
localized/en/1101
localized/en/1102
localized/en/1103
localized/en/1104
localized/en/1105
localized/en/1106
localized/en/1107
localized/en/1108
localized/en/1109
localized/en/111
localized/en/1110
localized/en/1111
localized/en/1112
localized/en/1113
localized/en/1117
localized/en/1122
localized/en/1124
localized/en/1131
localized/en/1136
localized/en/1142
localized/en/1143
localized/en/1144
localized/en/1146
localized/en/1147
localized/en/1149
localized/en/115
localized/en/1150
localized/en/1152
localized/en/1153
localized/en/1154
localized/en/1155
localized/en/1156
localized/en/1157
localized/en/1158
localized/en/1159
localized/en/116
localized/en/1160
localized/en/1161
localized/en/1162
localized/en/1163
localized/en/1164
localized/en/1165
localized/en/1166
localized/en/117
localized/en/1174
localized/en/1175
localized/en/118
localized/en/119
localized/en/12
localized/en/120
localized/en/1203
localized/en/121
localized/en/122
localized/en/1227
localized/en/123
localized/en/1231
localized/en/1233
localized/en/1236
localized/en/124
localized/en/1240
localized/en/1246
localized/en/125
localized/en/126
localized/en/1270
localized/en/1271
localized/en/1272
localized/en/1274
localized/en/1276
localized/en/1279
localized/en/13
localized/en/1307
localized/en/1308
localized/en/1337
localized/en/1338
localized/en/1346
localized/en/14
localized/en/15
localized/en/16
localized/en/1653
localized/en/1654
localized/en/1655
localized/en/1656
localized/en/1657
localized/en/1658
localized/en/1659
localized/en/1660
localized/en/1661
localized/en/1662
localized/en/1663
localized/en/1664
localized/en/1665
localized/en/1666
localized/en/1668
localized/en/1669
localized/en/1670
localized/en/1671
localized/en/1672
localized/en/1678
localized/en/1679
localized/en/1682
localized/en/1683
localized/en/1684
localized/en/1685
localized/en/1686
localized/en/1687
localized/en/1688
localized/en/1689
localized/en/1690
localized/en/1691
localized/en/1692
localized/en/1693
localized/en/1694
localized/en/1695
localized/en/1696
localized/en/1697
localized/en/1698
localized/en/1699
localized/en/17
localized/en/1700
localized/en/1701
localized/en/1703
localized/en/1711
localized/en/1717
localized/en/1718
localized/en/1723
localized/en/1724
localized/en/1725
localized/en/1726
localized/en/1727
localized/en/1728
localized/en/1730
localized/en/1731
localized/en/1732
localized/en/1733
localized/en/1734
localized/en/1735
localized/en/1736
localized/en/1737
localized/en/1738
localized/en/1739
localized/en/1740
localized/en/1741
localized/en/1742
localized/en/1743
localized/en/1744
localized/en/1745
localized/en/1746
localized/en/1747
localized/en/1748
localized/en/1749
localized/en/1750
localized/en/1751
localized/en/1753
localized/en/1759
localized/en/1771
localized/en/1774
localized/en/1781
localized/en/1790
localized/en/18
localized/en/1805
localized/en/1817
localized/en/1822
localized/en/1823
localized/en/1824
localized/en/1825
localized/en/1829
localized/en/1831
localized/en/1843
localized/en/1859
localized/en/1860
localized/en/1861
localized/en/1864
localized/en/1866
localized/en/1869
localized/en/1884
localized/en/1885
localized/en/1890
localized/en/1891
localized/en/19
localized/en/1910
localized/en/1911
localized/en/1913
localized/en/1928
localized/en/1935
localized/en/1952
localized/en/1953
localized/en/1956
localized/en/1957
localized/en/1958
localized/en/1982
localized/en/2
localized/en/20
localized/en/2008
localized/en/21
localized/en/22
localized/en/2222
localized/en/2223
localized/en/2224
localized/en/2225
localized/en/2226
localized/en/2227
localized/en/2228
localized/en/2229
localized/en/2230
localized/en/2231
localized/en/2232
localized/en/2233
localized/en/2234
localized/en/2235
localized/en/2236
localized/en/2237
localized/en/2238
localized/en/2239
localized/en/2240
localized/en/2241
localized/en/2242
localized/en/2243
localized/en/2244
localized/en/2245
localized/en/2246
localized/en/2247
localized/en/2248
localized/en/2249
localized/en/2250
localized/en/2251
localized/en/2252
localized/en/2253
localized/en/2254
localized/en/2255
localized/en/2256
localized/en/2257
localized/en/2258
localized/en/2259
localized/en/2260
localized/en/2261
localized/en/2262
localized/en/2263
localized/en/2264
localized/en/2265
localized/en/2266
localized/en/2267
localized/en/2268
localized/en/2269
localized/en/2272
localized/en/2273
localized/en/2274
localized/en/2275
localized/en/2284
localized/en/2285
localized/en/2287
localized/en/2288
localized/en/2289
localized/en/2290
localized/en/2291
localized/en/2292
localized/en/2293
localized/en/2294
localized/en/2295
localized/en/2296
localized/en/2297
localized/en/2298
localized/en/2299
localized/en/23
localized/en/2300
localized/en/2301
localized/en/2302
localized/en/2303
localized/en/2304
localized/en/2305
localized/en/2306
localized/en/2307
localized/en/2308
localized/en/2309
localized/en/2310
localized/en/2311
localized/en/2312
localized/en/2313
localized/en/2314
localized/en/2315
localized/en/2316
localized/en/2317
localized/en/2318
localized/en/2320
localized/en/2321
localized/en/2324
localized/en/2325
localized/en/2340
localized/en/2341
localized/en/2342
localized/en/2345
localized/en/2346
localized/en/2347
localized/en/2348
localized/en/2349
localized/en/2350
localized/en/2360
localized/en/2361
localized/en/2364
localized/en/2365
localized/en/2366
localized/en/2367
localized/en/2369
localized/en/2371
localized/en/2373
localized/en/2382
localized/en/2383
localized/en/2384
localized/en/2386
localized/en/2389
localized/en/2390
localized/en/2392
localized/en/2393
localized/en/2394
localized/en/2396
localized/en/2397
localized/en/2398
localized/en/24
localized/en/2404
localized/en/2406
localized/en/2407
localized/en/2408
localized/en/2409
localized/en/2410
localized/en/2411
localized/en/2413
localized/en/2414
localized/en/2415
localized/en/2416
localized/en/2417
localized/en/2418
localized/en/2419
localized/en/2420
localized/en/2425
localized/en/2426
localized/en/2427
localized/en/2428
localized/en/2429
localized/en/2430
localized/en/2431
localized/en/2432
localized/en/2441
localized/en/2442
localized/en/2443
localized/en/2444
localized/en/2445
localized/en/2446
localized/en/2447
localized/en/2448
localized/en/2449
localized/en/2457
localized/en/2470
localized/en/2477
localized/en/2481
localized/en/2482
localized/en/25
localized/en/254
localized/en/255
localized/en/256
localized/en/257
localized/en/258
localized/en/2597
localized/en/2598
localized/en/2599
localized/en/26
localized/en/2600
localized/en/2601
localized/en/2602
localized/en/2603
localized/en/2604
localized/en/2605
localized/en/2606
localized/en/2607
localized/en/2608
localized/en/2609
localized/en/2610
localized/en/2611
localized/en/2612
localized/en/2613
localized/en/2614
localized/en/2615
localized/en/2616
localized/en/2617
localized/en/2618
localized/en/2619
localized/en/262
localized/en/2620
localized/en/2621
localized/en/2622
localized/en/2623
localized/en/2624
localized/en/2625
localized/en/2626
localized/en/2627
localized/en/2628
localized/en/2629
localized/en/263
localized/en/2630
localized/en/2631
localized/en/2632
localized/en/2633
localized/en/2634
localized/en/2635
localized/en/2636
localized/en/2637
localized/en/2638
localized/en/2639
localized/en/264
localized/en/2640
localized/en/2641
localized/en/2642
localized/en/2643
localized/en/2644
localized/en/2645
localized/en/2648
localized/en/2649
localized/en/265
localized/en/2650
localized/en/2651
localized/en/2652
localized/en/2653
localized/en/2654
localized/en/2655
localized/en/2656
localized/en/2657
localized/en/2658
localized/en/2659
localized/en/266
localized/en/2660
localized/en/2661
localized/en/2662
localized/en/2663
localized/en/2664
localized/en/2665
localized/en/2667
localized/en/2669
localized/en/267
localized/en/2670
localized/en/2671
localized/en/2672
localized/en/2673
localized/en/2674
localized/en/2675
localized/en/2676
localized/en/2677
localized/en/2678
localized/en/2679
localized/en/268
localized/en/2680
localized/en/2681
localized/en/2682
localized/en/2683
localized/en/2684
localized/en/2685
localized/en/2686
localized/en/2687
localized/en/2689
localized/en/269
localized/en/2690
localized/en/2691
localized/en/2692
localized/en/2693
localized/en/2694
localized/en/2695
localized/en/2696
localized/en/2697
localized/en/2698
localized/en/2699
localized/en/27
localized/en/2700
localized/en/2705
localized/en/2706
localized/en/2707
localized/en/2708
localized/en/2709
localized/en/2710
localized/en/2714
localized/en/2715
localized/en/2716
localized/en/2718
localized/en/2721
localized/en/2723
localized/en/2724
localized/en/2725
localized/en/2727
localized/en/2728
localized/en/2729
localized/en/2730
localized/en/2735
localized/en/2736
localized/en/2737
localized/en/274
localized/en/2740
localized/en/2741
localized/en/2743
localized/en/2747
localized/en/2748
localized/en/275
localized/en/2755
localized/en/2756
localized/en/2758
localized/en/2759
localized/en/2762
localized/en/2763
localized/en/2766
localized/en/28
localized/en/2805
localized/en/2806
localized/en/2807
localized/en/2808
localized/en/2809
localized/en/2810
localized/en/2811
localized/en/2812
localized/en/2813
localized/en/2814
localized/en/2815
localized/en/2816
localized/en/2817
localized/en/2818
localized/en/2819
localized/en/2820
localized/en/2821
localized/en/2822
localized/en/2823
localized/en/2824
localized/en/2825
localized/en/2826
localized/en/2827
localized/en/2828
localized/en/2829
localized/en/2830
localized/en/2831
localized/en/2832
localized/en/2833
localized/en/2834
localized/en/2835
localized/en/2837
localized/en/2838
localized/en/2839
localized/en/2840
localized/en/2841
localized/en/2842
localized/en/2843
localized/en/2844
localized/en/2845
localized/en/2846
localized/en/2847
localized/en/2848
localized/en/2849
localized/en/2850
localized/en/2851
localized/en/2852
localized/en/2853
localized/en/2854
localized/en/2855
localized/en/2856
localized/en/2857
localized/en/2858
localized/en/2859
localized/en/286
localized/en/287
localized/en/288
localized/en/289
localized/en/290
localized/en/291
localized/en/292
localized/en/293
localized/en/294
localized/en/295
localized/en/296
localized/en/297
localized/en/298
localized/en/299
localized/en/3
localized/en/300
localized/en/301
localized/en/302
localized/en/303
localized/en/304
localized/en/305
localized/en/306
localized/en/309
localized/en/310
localized/en/324
localized/en/327
localized/en/330
localized/en/331
localized/en/333
localized/en/334
localized/en/335
localized/en/336
localized/en/337
localized/en/338
localized/en/339
localized/en/34
localized/en/340
localized/en/341
localized/en/342
localized/en/343
localized/en/344
localized/en/345
localized/en/346
localized/en/347
localized/en/349
localized/en/35
localized/en/350
localized/en/351
localized/en/352
localized/en/358
localized/en/36
localized/en/361
localized/en/37
localized/en/384
localized/en/385
localized/en/386
localized/en/387
localized/en/4
localized/en/406
localized/en/408
localized/en/41
localized/en/43
localized/en/44
localized/en/46
localized/en/47
localized/en/5
localized/en/6
localized/en/644
localized/en/645
localized/en/646
localized/en/647
localized/en/649
localized/en/65
localized/en/651
localized/en/652
localized/en/653
localized/en/66
localized/en/660
localized/en/661
localized/en/662
localized/en/663
localized/en/664
localized/en/665
localized/en/666
localized/en/669
localized/en/67
localized/en/673
localized/en/674
localized/en/675
localized/en/676
localized/en/677
localized/en/678
localized/en/679
localized/en/68
localized/en/680
localized/en/681
localized/en/682
localized/en/683
localized/en/684
localized/en/685
localized/en/686
localized/en/687
localized/en/688
localized/en/69
localized/en/690
localized/en/692
localized/en/693
localized/en/696
localized/en/697
localized/en/7
localized/en/70
localized/en/701
localized/en/702
localized/en/704
localized/en/705
localized/en/71
localized/en/716
localized/en/717
localized/en/718
localized/en/719
localized/en/72
localized/en/720
localized/en/721
localized/en/724
localized/en/725
localized/en/726
localized/en/727
localized/en/728
localized/en/729
localized/en/73
localized/en/730
localized/en/731
localized/en/732
localized/en/733
localized/en/734
localized/en/735
localized/en/737
localized/en/739
localized/en/740
localized/en/741
localized/en/743
localized/en/754
localized/en/755
localized/en/756
localized/en/757
localized/en/758
localized/en/759
localized/en/760
localized/en/761
localized/en/762
localized/en/763
localized/en/764
localized/en/765
localized/en/766
localized/en/767
localized/en/768
localized/en/771
localized/en/781
localized/en/782
localized/en/790
localized/en/797
localized/en/798
localized/en/799
localized/en/8
localized/en/800
localized/en/812
localized/en/813
localized/en/814
localized/en/815
localized/en/816
localized/en/82
localized/en/829
localized/en/830
localized/en/831
localized/en/832
localized/en/833
localized/en/89
localized/en/9
localized/en/90
localized/en/92
localized/es/1
localized/es/10
localized/es/1068
localized/es/1069
localized/es/1070
localized/es/1071
localized/es/1076
localized/es/1077
localized/es/1078
localized/es/1080
localized/es/1093
localized/es/11
localized/es/12
localized/es/13
localized/es/14
localized/es/1653
localized/es/1654
localized/es/1655
localized/es/1656
localized/es/1657
localized/es/1658
localized/es/1659
localized/es/1669
localized/es/1728
localized/es/1753
localized/es/1805
localized/es/19
localized/es/2
localized/es/2222
localized/es/2223
localized/es/2224
localized/es/2225
localized/es/2226
localized/es/2227
localized/es/2228
localized/es/2229
localized/es/2230
localized/es/2231
localized/es/2232
localized/es/2266
localized/es/2273
localized/es/2291
localized/es/2292
localized/es/23
localized/es/2324
localized/es/2382
localized/es/2383
localized/es/2384
localized/es/24
localized/es/254
localized/es/255
localized/es/256
localized/es/257
localized/es/258
localized/es/2597
localized/es/2598
localized/es/2599
localized/es/26
localized/es/2600
localized/es/2601
localized/es/2602
localized/es/2603
localized/es/2604
localized/es/2605
localized/es/2606
localized/es/2607
localized/es/2608
localized/es/2609
localized/es/2610
localized/es/2611
localized/es/2619
localized/es/262
localized/es/2620
localized/es/264
localized/es/2673
localized/es/2697
localized/es/2698
localized/es/27
localized/es/2705
localized/es/2715
localized/es/2724
localized/es/28
localized/es/2805
localized/es/2806
localized/es/2807
localized/es/2808
localized/es/2810
localized/es/2812
localized/es/2859
localized/es/3
localized/es/330
localized/es/34
localized/es/35
localized/es/358
localized/es/36
localized/es/361
localized/es/4
localized/es/408
localized/es/5
localized/es/6
localized/es/644
localized/es/645
localized/es/646
localized/es/647
localized/es/649
localized/es/663
localized/es/664
localized/es/665
localized/es/7
localized/es/720
localized/es/739
localized/es/799
localized/es/8
localized/es/800
localized/es/9
localized/et/2859
localized/et/739
localized/fi/1
localized/fi/10
localized/fi/1068
localized/fi/1069
localized/fi/1070
localized/fi/1071
localized/fi/1076
localized/fi/1077
localized/fi/1078
localized/fi/1080
localized/fi/1093
localized/fi/11
localized/fi/12
localized/fi/13
localized/fi/14
localized/fi/1653
localized/fi/1654
localized/fi/1655
localized/fi/1656
localized/fi/1657
localized/fi/1658
localized/fi/1659
localized/fi/1669
localized/fi/1728
localized/fi/1753
localized/fi/1805
localized/fi/19
localized/fi/2
localized/fi/2222
localized/fi/2223
localized/fi/2224
localized/fi/2225
localized/fi/2226
localized/fi/2227
localized/fi/2228
localized/fi/2229
localized/fi/2230
localized/fi/2231
localized/fi/2232
localized/fi/2266
localized/fi/2291
localized/fi/2292
localized/fi/23
localized/fi/2324
localized/fi/2382
localized/fi/2383
localized/fi/2384
localized/fi/24
localized/fi/254
localized/fi/255
localized/fi/256
localized/fi/257
localized/fi/258
localized/fi/2597
localized/fi/2598
localized/fi/2599
localized/fi/26
localized/fi/2600
localized/fi/2601
localized/fi/2602
localized/fi/2603
localized/fi/2604
localized/fi/2605
localized/fi/2606
localized/fi/2607
localized/fi/2608
localized/fi/2609
localized/fi/2610
localized/fi/2611
localized/fi/2619
localized/fi/262
localized/fi/2620
localized/fi/264
localized/fi/2673
localized/fi/2697
localized/fi/2698
localized/fi/27
localized/fi/2705
localized/fi/2715
localized/fi/2724
localized/fi/28
localized/fi/2805
localized/fi/2806
localized/fi/2807
localized/fi/2808
localized/fi/2810
localized/fi/2812
localized/fi/2859
localized/fi/3
localized/fi/330
localized/fi/34
localized/fi/35
localized/fi/358
localized/fi/36
localized/fi/361
localized/fi/4
localized/fi/408
localized/fi/5
localized/fi/6
localized/fi/644
localized/fi/645
localized/fi/646
localized/fi/647
localized/fi/649
localized/fi/663
localized/fi/664
localized/fi/665
localized/fi/7
localized/fi/720
localized/fi/739
localized/fi/799
localized/fi/8
localized/fi/800
localized/fi/9
localized/fr/1
localized/fr/10
localized/fr/1068
localized/fr/1069
localized/fr/1070
localized/fr/1071
localized/fr/1076
localized/fr/1077
localized/fr/1078
localized/fr/1080
localized/fr/1093
localized/fr/11
localized/fr/12
localized/fr/13
localized/fr/14
localized/fr/1653
localized/fr/1654
localized/fr/1655
localized/fr/1656
localized/fr/1657
localized/fr/1658
localized/fr/1659
localized/fr/1669
localized/fr/1728
localized/fr/1753
localized/fr/1805
localized/fr/19
localized/fr/2
localized/fr/2222
localized/fr/2223
localized/fr/2224
localized/fr/2225
localized/fr/2226
localized/fr/2227
localized/fr/2228
localized/fr/2229
localized/fr/2230
localized/fr/2231
localized/fr/2232
localized/fr/2266
localized/fr/2273
localized/fr/2291
localized/fr/2292
localized/fr/23
localized/fr/2324
localized/fr/2382
localized/fr/2383
localized/fr/2384
localized/fr/24
localized/fr/254
localized/fr/255
localized/fr/256
localized/fr/257
localized/fr/258
localized/fr/2597
localized/fr/2598
localized/fr/2599
localized/fr/26
localized/fr/2600
localized/fr/2601
localized/fr/2602
localized/fr/2603
localized/fr/2604
localized/fr/2605
localized/fr/2606
localized/fr/2607
localized/fr/2608
localized/fr/2609
localized/fr/2610
localized/fr/2611
localized/fr/2619
localized/fr/262
localized/fr/2620
localized/fr/264
localized/fr/2673
localized/fr/2697
localized/fr/2698
localized/fr/27
localized/fr/2705
localized/fr/2715
localized/fr/2724
localized/fr/28
localized/fr/2805
localized/fr/2806
localized/fr/2807
localized/fr/2808
localized/fr/2810
localized/fr/2812
localized/fr/2859
localized/fr/3
localized/fr/330
localized/fr/34
localized/fr/35
localized/fr/358
localized/fr/36
localized/fr/361
localized/fr/4
localized/fr/408
localized/fr/5
localized/fr/6
localized/fr/644
localized/fr/645
localized/fr/646
localized/fr/647
localized/fr/649
localized/fr/663
localized/fr/664
localized/fr/665
localized/fr/7
localized/fr/720
localized/fr/739
localized/fr/799
localized/fr/8
localized/fr/800
localized/fr/9
localized/he/1
localized/he/10
localized/he/1068
localized/he/1069
localized/he/1070
localized/he/1071
localized/he/1076
localized/he/1077
localized/he/1078
localized/he/1080
localized/he/1093
localized/he/11
localized/he/12
localized/he/13
localized/he/14
localized/he/1653
localized/he/1654
localized/he/1655
localized/he/1656
localized/he/1657
localized/he/1658
localized/he/1659
localized/he/1669
localized/he/1728
localized/he/1753
localized/he/1805
localized/he/19
localized/he/2
localized/he/2222
localized/he/2223
localized/he/2224
localized/he/2225
localized/he/2226
localized/he/2227
localized/he/2228
localized/he/2229
localized/he/2230
localized/he/2231
localized/he/2232
localized/he/2266
localized/he/2291
localized/he/2292
localized/he/23
localized/he/2324
localized/he/2382
localized/he/2383
localized/he/2384
localized/he/24
localized/he/254
localized/he/255
localized/he/256
localized/he/257
localized/he/258
localized/he/2597
localized/he/2598
localized/he/2599
localized/he/26
localized/he/2600
localized/he/2601
localized/he/2602
localized/he/2603
localized/he/2604
localized/he/2605
localized/he/2606
localized/he/2607
localized/he/2608
localized/he/2609
localized/he/2610
localized/he/2611
localized/he/2619
localized/he/262
localized/he/2620
localized/he/264
localized/he/2673
localized/he/2697
localized/he/2698
localized/he/27
localized/he/2705
localized/he/2715
localized/he/2724
localized/he/28
localized/he/2805
localized/he/2806
localized/he/2807
localized/he/2808
localized/he/2810
localized/he/2812
localized/he/2859
localized/he/3
localized/he/330
localized/he/34
localized/he/35
localized/he/358
localized/he/36
localized/he/361
localized/he/4
localized/he/408
localized/he/5
localized/he/6
localized/he/644
localized/he/645
localized/he/646
localized/he/647
localized/he/649
localized/he/663
localized/he/664
localized/he/665
localized/he/7
localized/he/720
localized/he/739
localized/he/799
localized/he/8
localized/he/800
localized/he/9
localized/hr/2859
localized/hr/739
localized/hu/1
localized/hu/10
localized/hu/1068
localized/hu/1069
localized/hu/1070
localized/hu/1071
localized/hu/1076
localized/hu/1077
localized/hu/1078
localized/hu/1080
localized/hu/1093
localized/hu/11
localized/hu/12
localized/hu/13
localized/hu/14
localized/hu/1653
localized/hu/1654
localized/hu/1655
localized/hu/1656
localized/hu/1657
localized/hu/1658
localized/hu/1659
localized/hu/1669
localized/hu/1728
localized/hu/1753
localized/hu/1805
localized/hu/19
localized/hu/2
localized/hu/2222
localized/hu/2223
localized/hu/2224
localized/hu/2225
localized/hu/2226
localized/hu/2227
localized/hu/2228
localized/hu/2229
localized/hu/2230
localized/hu/2231
localized/hu/2232
localized/hu/2266
localized/hu/2291
localized/hu/2292
localized/hu/23
localized/hu/2324
localized/hu/2382
localized/hu/2383
localized/hu/2384
localized/hu/24
localized/hu/254
localized/hu/255
localized/hu/256
localized/hu/257
localized/hu/258
localized/hu/2597
localized/hu/2598
localized/hu/2599
localized/hu/26
localized/hu/2600
localized/hu/2601
localized/hu/2602
localized/hu/2603
localized/hu/2604
localized/hu/2605
localized/hu/2606
localized/hu/2607
localized/hu/2608
localized/hu/2609
localized/hu/2610
localized/hu/2611
localized/hu/2619
localized/hu/262
localized/hu/2620
localized/hu/264
localized/hu/2673
localized/hu/2697
localized/hu/2698
localized/hu/27
localized/hu/2705
localized/hu/2715
localized/hu/2724
localized/hu/28
localized/hu/2805
localized/hu/2806
localized/hu/2807
localized/hu/2808
localized/hu/2810
localized/hu/2812
localized/hu/2859
localized/hu/3
localized/hu/330
localized/hu/34
localized/hu/35
localized/hu/358
localized/hu/36
localized/hu/361
localized/hu/4
localized/hu/408
localized/hu/5
localized/hu/6
localized/hu/644
localized/hu/645
localized/hu/646
localized/hu/647
localized/hu/649
localized/hu/663
localized/hu/664
localized/hu/665
localized/hu/7
localized/hu/720
localized/hu/739
localized/hu/799
localized/hu/8
localized/hu/800
localized/hu/9
localized/it/1
localized/it/10
localized/it/1068
localized/it/1069
localized/it/1070
localized/it/1071
localized/it/1076
localized/it/1077
localized/it/1078
localized/it/1080
localized/it/1093
localized/it/11
localized/it/12
localized/it/13
localized/it/14
localized/it/1653
localized/it/1654
localized/it/1655
localized/it/1656
localized/it/1657
localized/it/1658
localized/it/1659
localized/it/1669
localized/it/1728
localized/it/1753
localized/it/1805
localized/it/19
localized/it/2
localized/it/2222
localized/it/2223
localized/it/2224
localized/it/2225
localized/it/2226
localized/it/2227
localized/it/2228
localized/it/2229
localized/it/2230
localized/it/2231
localized/it/2232
localized/it/2266
localized/it/2273
localized/it/2291
localized/it/2292
localized/it/23
localized/it/2324
localized/it/2382
localized/it/2383
localized/it/2384
localized/it/24
localized/it/254
localized/it/255
localized/it/256
localized/it/257
localized/it/258
localized/it/2597
localized/it/2598
localized/it/2599
localized/it/26
localized/it/2600
localized/it/2601
localized/it/2602
localized/it/2603
localized/it/2604
localized/it/2605
localized/it/2606
localized/it/2607
localized/it/2608
localized/it/2609
localized/it/2610
localized/it/2611
localized/it/2619
localized/it/262
localized/it/2620
localized/it/264
localized/it/2673
localized/it/2697
localized/it/2698
localized/it/27
localized/it/2705
localized/it/2715
localized/it/2724
localized/it/28
localized/it/2805
localized/it/2806
localized/it/2807
localized/it/2808
localized/it/2810
localized/it/2812
localized/it/2859
localized/it/3
localized/it/330
localized/it/34
localized/it/35
localized/it/358
localized/it/36
localized/it/361
localized/it/4
localized/it/408
localized/it/5
localized/it/6
localized/it/644
localized/it/645
localized/it/646
localized/it/647
localized/it/649
localized/it/663
localized/it/664
localized/it/665
localized/it/7
localized/it/720
localized/it/739
localized/it/799
localized/it/8
localized/it/800
localized/it/9
localized/ja/1
localized/ja/10
localized/ja/1068
localized/ja/1069
localized/ja/1070
localized/ja/1071
localized/ja/1076
localized/ja/1077
localized/ja/1078
localized/ja/1080
localized/ja/1093
localized/ja/11
localized/ja/12
localized/ja/13
localized/ja/14
localized/ja/1653
localized/ja/1654
localized/ja/1655
localized/ja/1656
localized/ja/1657
localized/ja/1658
localized/ja/1659
localized/ja/1669
localized/ja/1728
localized/ja/1753
localized/ja/1805
localized/ja/19
localized/ja/2
localized/ja/2222
localized/ja/2223
localized/ja/2224
localized/ja/2225
localized/ja/2226
localized/ja/2227
localized/ja/2228
localized/ja/2229
localized/ja/2230
localized/ja/2231
localized/ja/2232
localized/ja/2266
localized/ja/2273
localized/ja/2291
localized/ja/2292
localized/ja/23
localized/ja/2324
localized/ja/2382
localized/ja/2383
localized/ja/2384
localized/ja/24
localized/ja/254
localized/ja/255
localized/ja/256
localized/ja/257
localized/ja/258
localized/ja/2597
localized/ja/2598
localized/ja/2599
localized/ja/26
localized/ja/2600
localized/ja/2601
localized/ja/2602
localized/ja/2603
localized/ja/2604
localized/ja/2605
localized/ja/2606
localized/ja/2607
localized/ja/2608
localized/ja/2609
localized/ja/2610
localized/ja/2611
localized/ja/2619
localized/ja/262
localized/ja/2620
localized/ja/264
localized/ja/2673
localized/ja/2697
localized/ja/2698
localized/ja/27
localized/ja/2705
localized/ja/2715
localized/ja/2724
localized/ja/28
localized/ja/2805
localized/ja/2806
localized/ja/2807
localized/ja/2808
localized/ja/2810
localized/ja/2812
localized/ja/2859
localized/ja/3
localized/ja/330
localized/ja/34
localized/ja/35
localized/ja/358
localized/ja/36
localized/ja/361
localized/ja/4
localized/ja/408
localized/ja/5
localized/ja/6
localized/ja/644
localized/ja/645
localized/ja/646
localized/ja/647
localized/ja/649
localized/ja/663
localized/ja/664
localized/ja/665
localized/ja/7
localized/ja/720
localized/ja/739
localized/ja/799
localized/ja/8
localized/ja/800
localized/ja/9
localized/ko/1
localized/ko/10
localized/ko/1068
localized/ko/1069
localized/ko/1070
localized/ko/1071
localized/ko/1076
localized/ko/1077
localized/ko/1078
localized/ko/1080
localized/ko/1093
localized/ko/11
localized/ko/12
localized/ko/13
localized/ko/14
localized/ko/1653
localized/ko/1654
localized/ko/1655
localized/ko/1656
localized/ko/1657
localized/ko/1658
localized/ko/1659
localized/ko/1669
localized/ko/1728
localized/ko/1753
localized/ko/1805
localized/ko/19
localized/ko/2
localized/ko/2222
localized/ko/2223
localized/ko/2224
localized/ko/2225
localized/ko/2226
localized/ko/2227
localized/ko/2228
localized/ko/2229
localized/ko/2230
localized/ko/2231
localized/ko/2232
localized/ko/2266
localized/ko/2273
localized/ko/2291
localized/ko/2292
localized/ko/23
localized/ko/2324
localized/ko/2382
localized/ko/2383
localized/ko/2384
localized/ko/24
localized/ko/254
localized/ko/255
localized/ko/256
localized/ko/257
localized/ko/258
localized/ko/2597
localized/ko/2598
localized/ko/2599
localized/ko/26
localized/ko/2600
localized/ko/2601
localized/ko/2602
localized/ko/2603
localized/ko/2604
localized/ko/2605
localized/ko/2606
localized/ko/2607
localized/ko/2608
localized/ko/2609
localized/ko/2610
localized/ko/2611
localized/ko/2619
localized/ko/262
localized/ko/2620
localized/ko/264
localized/ko/2673
localized/ko/2697
localized/ko/2698
localized/ko/27
localized/ko/2705
localized/ko/2715
localized/ko/2724
localized/ko/28
localized/ko/2805
localized/ko/2806
localized/ko/2807
localized/ko/2808
localized/ko/2810
localized/ko/2812
localized/ko/2859
localized/ko/3
localized/ko/330
localized/ko/34
localized/ko/35
localized/ko/358
localized/ko/36
localized/ko/361
localized/ko/4
localized/ko/408
localized/ko/5
localized/ko/6
localized/ko/644
localized/ko/645
localized/ko/646
localized/ko/647
localized/ko/649
localized/ko/663
localized/ko/664
localized/ko/665
localized/ko/7
localized/ko/720
localized/ko/739
localized/ko/799
localized/ko/8
localized/ko/800
localized/ko/9
localized/lt/2859
localized/lt/739
localized/lv/2859
localized/lv/739
localized/neu/2859
localized/nl/1
localized/nl/10
localized/nl/1068
localized/nl/1069
localized/nl/1070
localized/nl/1071
localized/nl/1076
localized/nl/1077
localized/nl/1078
localized/nl/1080
localized/nl/1093
localized/nl/11
localized/nl/12
localized/nl/13
localized/nl/14
localized/nl/1653
localized/nl/1654
localized/nl/1655
localized/nl/1656
localized/nl/1657
localized/nl/1658
localized/nl/1659
localized/nl/1669
localized/nl/1728
localized/nl/1753
localized/nl/1805
localized/nl/19
localized/nl/2
localized/nl/2222
localized/nl/2223
localized/nl/2224
localized/nl/2225
localized/nl/2226
localized/nl/2227
localized/nl/2228
localized/nl/2229
localized/nl/2230
localized/nl/2231
localized/nl/2232
localized/nl/2266
localized/nl/2291
localized/nl/2292
localized/nl/23
localized/nl/2324
localized/nl/2382
localized/nl/2383
localized/nl/2384
localized/nl/24
localized/nl/254
localized/nl/255
localized/nl/256
localized/nl/257
localized/nl/258
localized/nl/2597
localized/nl/2598
localized/nl/2599
localized/nl/26
localized/nl/2600
localized/nl/2601
localized/nl/2602
localized/nl/2603
localized/nl/2604
localized/nl/2605
localized/nl/2606
localized/nl/2607
localized/nl/2608
localized/nl/2609
localized/nl/2610
localized/nl/2611
localized/nl/2619
localized/nl/262
localized/nl/2620
localized/nl/264
localized/nl/2673
localized/nl/2697
localized/nl/2698
localized/nl/27
localized/nl/2705
localized/nl/2715
localized/nl/2724
localized/nl/28
localized/nl/2805
localized/nl/2806
localized/nl/2807
localized/nl/2808
localized/nl/2810
localized/nl/2812
localized/nl/2859
localized/nl/3
localized/nl/330
localized/nl/34
localized/nl/35
localized/nl/358
localized/nl/36
localized/nl/361
localized/nl/4
localized/nl/408
localized/nl/5
localized/nl/6
localized/nl/644
localized/nl/645
localized/nl/646
localized/nl/647
localized/nl/649
localized/nl/663
localized/nl/664
localized/nl/665
localized/nl/7
localized/nl/720
localized/nl/739
localized/nl/799
localized/nl/8
localized/nl/800
localized/nl/9
localized/no/1
localized/no/10
localized/no/1068
localized/no/1069
localized/no/1070
localized/no/1071
localized/no/1076
localized/no/1077
localized/no/1078
localized/no/1080
localized/no/1093
localized/no/11
localized/no/12
localized/no/13
localized/no/14
localized/no/1653
localized/no/1654
localized/no/1655
localized/no/1656
localized/no/1657
localized/no/1658
localized/no/1659
localized/no/1669
localized/no/1728
localized/no/1753
localized/no/1805
localized/no/19
localized/no/2
localized/no/2222
localized/no/2223
localized/no/2224
localized/no/2225
localized/no/2226
localized/no/2227
localized/no/2228
localized/no/2229
localized/no/2230
localized/no/2231
localized/no/2232
localized/no/2266
localized/no/2291
localized/no/2292
localized/no/23
localized/no/2324
localized/no/2382
localized/no/2383
localized/no/2384
localized/no/24
localized/no/254
localized/no/255
localized/no/256
localized/no/257
localized/no/258
localized/no/2597
localized/no/2598
localized/no/2599
localized/no/26
localized/no/2600
localized/no/2601
localized/no/2602
localized/no/2603
localized/no/2604
localized/no/2605
localized/no/2606
localized/no/2607
localized/no/2608
localized/no/2609
localized/no/2610
localized/no/2611
localized/no/2619
localized/no/262
localized/no/2620
localized/no/264
localized/no/2673
localized/no/2697
localized/no/2698
localized/no/27
localized/no/2705
localized/no/2715
localized/no/2724
localized/no/28
localized/no/2805
localized/no/2806
localized/no/2807
localized/no/2808
localized/no/2810
localized/no/2812
localized/no/2859
localized/no/3
localized/no/330
localized/no/34
localized/no/35
localized/no/358
localized/no/36
localized/no/361
localized/no/4
localized/no/408
localized/no/5
localized/no/6
localized/no/644
localized/no/645
localized/no/646
localized/no/647
localized/no/649
localized/no/663
localized/no/664
localized/no/665
localized/no/7
localized/no/720
localized/no/739
localized/no/799
localized/no/8
localized/no/800
localized/no/9
localized/pl/1
localized/pl/10
localized/pl/1068
localized/pl/1069
localized/pl/1070
localized/pl/1071
localized/pl/1076
localized/pl/1077
localized/pl/1078
localized/pl/1080
localized/pl/1093
localized/pl/11
localized/pl/12
localized/pl/13
localized/pl/14
localized/pl/1653
localized/pl/1654
localized/pl/1655
localized/pl/1656
localized/pl/1657
localized/pl/1658
localized/pl/1659
localized/pl/1669
localized/pl/1728
localized/pl/1753
localized/pl/1805
localized/pl/19
localized/pl/2
localized/pl/2222
localized/pl/2223
localized/pl/2224
localized/pl/2225
localized/pl/2226
localized/pl/2227
localized/pl/2228
localized/pl/2229
localized/pl/2230
localized/pl/2231
localized/pl/2232
localized/pl/2266
localized/pl/2291
localized/pl/2292
localized/pl/23
localized/pl/2324
localized/pl/2382
localized/pl/2383
localized/pl/2384
localized/pl/24
localized/pl/254
localized/pl/255
localized/pl/256
localized/pl/257
localized/pl/258
localized/pl/2597
localized/pl/2598
localized/pl/2599
localized/pl/26
localized/pl/2600
localized/pl/2601
localized/pl/2602
localized/pl/2603
localized/pl/2604
localized/pl/2605
localized/pl/2606
localized/pl/2607
localized/pl/2608
localized/pl/2609
localized/pl/2610
localized/pl/2611
localized/pl/2619
localized/pl/262
localized/pl/2620
localized/pl/264
localized/pl/2673
localized/pl/2697
localized/pl/2698
localized/pl/27
localized/pl/2705
localized/pl/2715
localized/pl/2724
localized/pl/28
localized/pl/2805
localized/pl/2806
localized/pl/2807
localized/pl/2808
localized/pl/2810
localized/pl/2812
localized/pl/2859
localized/pl/3
localized/pl/330
localized/pl/34
localized/pl/35
localized/pl/358
localized/pl/36
localized/pl/361
localized/pl/4
localized/pl/408
localized/pl/5
localized/pl/6
localized/pl/644
localized/pl/645
localized/pl/646
localized/pl/647
localized/pl/649
localized/pl/663
localized/pl/664
localized/pl/665
localized/pl/7
localized/pl/720
localized/pl/739
localized/pl/799
localized/pl/8
localized/pl/800
localized/pl/9
localized/pt-br/1
localized/pt-br/10
localized/pt-br/1068
localized/pt-br/1069
localized/pt-br/1070
localized/pt-br/1071
localized/pt-br/1076
localized/pt-br/1077
localized/pt-br/1078
localized/pt-br/1080
localized/pt-br/1093
localized/pt-br/11
localized/pt-br/12
localized/pt-br/13
localized/pt-br/14
localized/pt-br/1653
localized/pt-br/1654
localized/pt-br/1655
localized/pt-br/1656
localized/pt-br/1657
localized/pt-br/1658
localized/pt-br/1659
localized/pt-br/1669
localized/pt-br/1728
localized/pt-br/1753
localized/pt-br/1805
localized/pt-br/19
localized/pt-br/2
localized/pt-br/2222
localized/pt-br/2223
localized/pt-br/2224
localized/pt-br/2225
localized/pt-br/2226
localized/pt-br/2227
localized/pt-br/2228
localized/pt-br/2229
localized/pt-br/2230
localized/pt-br/2231
localized/pt-br/2232
localized/pt-br/2266
localized/pt-br/2291
localized/pt-br/2292
localized/pt-br/23
localized/pt-br/2324
localized/pt-br/2382
localized/pt-br/2383
localized/pt-br/2384
localized/pt-br/24
localized/pt-br/254
localized/pt-br/255
localized/pt-br/256
localized/pt-br/257
localized/pt-br/258
localized/pt-br/2597
localized/pt-br/2598
localized/pt-br/2599
localized/pt-br/26
localized/pt-br/2600
localized/pt-br/2601
localized/pt-br/2602
localized/pt-br/2603
localized/pt-br/2604
localized/pt-br/2605
localized/pt-br/2606
localized/pt-br/2607
localized/pt-br/2608
localized/pt-br/2609
localized/pt-br/2610
localized/pt-br/2611
localized/pt-br/2619
localized/pt-br/262
localized/pt-br/2620
localized/pt-br/264
localized/pt-br/2673
localized/pt-br/2697
localized/pt-br/2698
localized/pt-br/27
localized/pt-br/2705
localized/pt-br/2715
localized/pt-br/2724
localized/pt-br/28
localized/pt-br/2805
localized/pt-br/2806
localized/pt-br/2807
localized/pt-br/2808
localized/pt-br/2810
localized/pt-br/2812
localized/pt-br/2859
localized/pt-br/3
localized/pt-br/330
localized/pt-br/34
localized/pt-br/35
localized/pt-br/358
localized/pt-br/36
localized/pt-br/361
localized/pt-br/4
localized/pt-br/408
localized/pt-br/5
localized/pt-br/6
localized/pt-br/644
localized/pt-br/645
localized/pt-br/646
localized/pt-br/647
localized/pt-br/649
localized/pt-br/663
localized/pt-br/664
localized/pt-br/665
localized/pt-br/7
localized/pt-br/720
localized/pt-br/739
localized/pt-br/799
localized/pt-br/8
localized/pt-br/800
localized/pt-br/9
localized/pt/1
localized/pt/10
localized/pt/1068
localized/pt/1069
localized/pt/1070
localized/pt/1071
localized/pt/1076
localized/pt/1077
localized/pt/1078
localized/pt/1080
localized/pt/1093
localized/pt/11
localized/pt/12
localized/pt/13
localized/pt/14
localized/pt/1653
localized/pt/1654
localized/pt/1655
localized/pt/1656
localized/pt/1657
localized/pt/1658
localized/pt/1659
localized/pt/1669
localized/pt/1728
localized/pt/1753
localized/pt/1805
localized/pt/19
localized/pt/2
localized/pt/2222
localized/pt/2223
localized/pt/2224
localized/pt/2225
localized/pt/2226
localized/pt/2227
localized/pt/2228
localized/pt/2229
localized/pt/2230
localized/pt/2231
localized/pt/2232
localized/pt/2266
localized/pt/2291
localized/pt/2292
localized/pt/23
localized/pt/2324
localized/pt/2382
localized/pt/2383
localized/pt/2384
localized/pt/24
localized/pt/254
localized/pt/255
localized/pt/256
localized/pt/257
localized/pt/258
localized/pt/2597
localized/pt/2598
localized/pt/2599
localized/pt/26
localized/pt/2600
localized/pt/2601
localized/pt/2602
localized/pt/2603
localized/pt/2604
localized/pt/2605
localized/pt/2606
localized/pt/2607
localized/pt/2608
localized/pt/2609
localized/pt/2610
localized/pt/2611
localized/pt/2619
localized/pt/262
localized/pt/2620
localized/pt/264
localized/pt/2673
localized/pt/2697
localized/pt/2698
localized/pt/27
localized/pt/2705
localized/pt/2715
localized/pt/2724
localized/pt/28
localized/pt/2805
localized/pt/2806
localized/pt/2807
localized/pt/2808
localized/pt/2810
localized/pt/2812
localized/pt/2859
localized/pt/3
localized/pt/330
localized/pt/34
localized/pt/35
localized/pt/358
localized/pt/36
localized/pt/361
localized/pt/4
localized/pt/408
localized/pt/5
localized/pt/6
localized/pt/644
localized/pt/645
localized/pt/646
localized/pt/647
localized/pt/649
localized/pt/663
localized/pt/664
localized/pt/665
localized/pt/7
localized/pt/720
localized/pt/739
localized/pt/799
localized/pt/8
localized/pt/800
localized/pt/9
localized/ro/2859
localized/ro/739
localized/ru/1
localized/ru/10
localized/ru/1068
localized/ru/1069
localized/ru/1070
localized/ru/1071
localized/ru/1076
localized/ru/1077
localized/ru/1078
localized/ru/1080
localized/ru/1093
localized/ru/11
localized/ru/12
localized/ru/13
localized/ru/14
localized/ru/1653
localized/ru/1654
localized/ru/1655
localized/ru/1656
localized/ru/1657
localized/ru/1658
localized/ru/1659
localized/ru/1669
localized/ru/1728
localized/ru/1753
localized/ru/1805
localized/ru/19
localized/ru/2
localized/ru/2222
localized/ru/2223
localized/ru/2224
localized/ru/2225
localized/ru/2226
localized/ru/2227
localized/ru/2228
localized/ru/2229
localized/ru/2230
localized/ru/2231
localized/ru/2232
localized/ru/2266
localized/ru/2291
localized/ru/2292
localized/ru/23
localized/ru/2324
localized/ru/2382
localized/ru/2383
localized/ru/2384
localized/ru/24
localized/ru/254
localized/ru/255
localized/ru/256
localized/ru/257
localized/ru/258
localized/ru/2597
localized/ru/2598
localized/ru/2599
localized/ru/26
localized/ru/2600
localized/ru/2601
localized/ru/2602
localized/ru/2603
localized/ru/2604
localized/ru/2605
localized/ru/2606
localized/ru/2607
localized/ru/2608
localized/ru/2609
localized/ru/2610
localized/ru/2611
localized/ru/2619
localized/ru/262
localized/ru/2620
localized/ru/264
localized/ru/2673
localized/ru/2697
localized/ru/2698
localized/ru/27
localized/ru/2705
localized/ru/2715
localized/ru/2724
localized/ru/28
localized/ru/2805
localized/ru/2806
localized/ru/2807
localized/ru/2808
localized/ru/2810
localized/ru/2812
localized/ru/2859
localized/ru/3
localized/ru/330
localized/ru/34
localized/ru/35
localized/ru/358
localized/ru/36
localized/ru/361
localized/ru/4
localized/ru/408
localized/ru/5
localized/ru/6
localized/ru/644
localized/ru/645
localized/ru/646
localized/ru/647
localized/ru/649
localized/ru/663
localized/ru/664
localized/ru/665
localized/ru/7
localized/ru/720
localized/ru/739
localized/ru/799
localized/ru/8
localized/ru/800
localized/ru/9
localized/sk/2859
localized/sk/739
localized/sl/2859
localized/sl/739
localized/sr/2859
localized/sr/739
localized/sv/1
localized/sv/10
localized/sv/1068
localized/sv/1069
localized/sv/1070
localized/sv/1071
localized/sv/1076
localized/sv/1077
localized/sv/1078
localized/sv/1080
localized/sv/1093
localized/sv/11
localized/sv/12
localized/sv/13
localized/sv/14
localized/sv/1653
localized/sv/1654
localized/sv/1655
localized/sv/1656
localized/sv/1657
localized/sv/1658
localized/sv/1659
localized/sv/1669
localized/sv/1728
localized/sv/1753
localized/sv/1805
localized/sv/19
localized/sv/2
localized/sv/2222
localized/sv/2223
localized/sv/2224
localized/sv/2225
localized/sv/2226
localized/sv/2227
localized/sv/2228
localized/sv/2229
localized/sv/2230
localized/sv/2231
localized/sv/2232
localized/sv/2266
localized/sv/2291
localized/sv/2292
localized/sv/23
localized/sv/2324
localized/sv/2382
localized/sv/2383
localized/sv/2384
localized/sv/24
localized/sv/254
localized/sv/255
localized/sv/256
localized/sv/257
localized/sv/258
localized/sv/2597
localized/sv/2598
localized/sv/2599
localized/sv/26
localized/sv/2600
localized/sv/2601
localized/sv/2602
localized/sv/2603
localized/sv/2604
localized/sv/2605
localized/sv/2606
localized/sv/2607
localized/sv/2608
localized/sv/2609
localized/sv/2610
localized/sv/2611
localized/sv/2619
localized/sv/262
localized/sv/2620
localized/sv/264
localized/sv/2673
localized/sv/2697
localized/sv/2698
localized/sv/27
localized/sv/2705
localized/sv/2715
localized/sv/2724
localized/sv/28
localized/sv/2805
localized/sv/2806
localized/sv/2807
localized/sv/2808
localized/sv/2810
localized/sv/2812
localized/sv/2859
localized/sv/3
localized/sv/330
localized/sv/34
localized/sv/35
localized/sv/358
localized/sv/36
localized/sv/361
localized/sv/4
localized/sv/408
localized/sv/5
localized/sv/6
localized/sv/644
localized/sv/645
localized/sv/646
localized/sv/647
localized/sv/649
localized/sv/663
localized/sv/664
localized/sv/665
localized/sv/7
localized/sv/720
localized/sv/739
localized/sv/799
localized/sv/8
localized/sv/800
localized/sv/9
localized/th/2859
localized/th/739
localized/tr/1
localized/tr/10
localized/tr/1068
localized/tr/1069
localized/tr/1070
localized/tr/1071
localized/tr/1076
localized/tr/1077
localized/tr/1078
localized/tr/1080
localized/tr/1093
localized/tr/11
localized/tr/12
localized/tr/13
localized/tr/14
localized/tr/1653
localized/tr/1654
localized/tr/1655
localized/tr/1656
localized/tr/1657
localized/tr/1658
localized/tr/1659
localized/tr/1669
localized/tr/1728
localized/tr/1753
localized/tr/1805
localized/tr/19
localized/tr/2
localized/tr/2222
localized/tr/2223
localized/tr/2224
localized/tr/2225
localized/tr/2226
localized/tr/2227
localized/tr/2228
localized/tr/2229
localized/tr/2230
localized/tr/2231
localized/tr/2232
localized/tr/2266
localized/tr/2291
localized/tr/2292
localized/tr/23
localized/tr/2324
localized/tr/2382
localized/tr/2383
localized/tr/2384
localized/tr/24
localized/tr/254
localized/tr/255
localized/tr/256
localized/tr/257
localized/tr/258
localized/tr/2597
localized/tr/2598
localized/tr/2599
localized/tr/26
localized/tr/2600
localized/tr/2601
localized/tr/2602
localized/tr/2603
localized/tr/2604
localized/tr/2605
localized/tr/2606
localized/tr/2607
localized/tr/2608
localized/tr/2609
localized/tr/2610
localized/tr/2611
localized/tr/2619
localized/tr/262
localized/tr/2620
localized/tr/264
localized/tr/2673
localized/tr/2697
localized/tr/2698
localized/tr/27
localized/tr/2705
localized/tr/2715
localized/tr/2724
localized/tr/28
localized/tr/2805
localized/tr/2806
localized/tr/2807
localized/tr/2808
localized/tr/2810
localized/tr/2812
localized/tr/2859
localized/tr/3
localized/tr/330
localized/tr/34
localized/tr/35
localized/tr/358
localized/tr/36
localized/tr/361
localized/tr/4
localized/tr/408
localized/tr/5
localized/tr/6
localized/tr/644
localized/tr/645
localized/tr/646
localized/tr/647
localized/tr/649
localized/tr/663
localized/tr/664
localized/tr/665
localized/tr/7
localized/tr/720
localized/tr/739
localized/tr/799
localized/tr/8
localized/tr/800
localized/tr/9
localized/uk/2859
localized/uk/739
localized/zh-HK/2859
localized/zh-HK/739
localized/zh-cn/1
localized/zh-cn/10
localized/zh-cn/1068
localized/zh-cn/1069
localized/zh-cn/1070
localized/zh-cn/1071
localized/zh-cn/1076
localized/zh-cn/1077
localized/zh-cn/1078
localized/zh-cn/1080
localized/zh-cn/1093
localized/zh-cn/11
localized/zh-cn/12
localized/zh-cn/13
localized/zh-cn/14
localized/zh-cn/1653
localized/zh-cn/1654
localized/zh-cn/1655
localized/zh-cn/1656
localized/zh-cn/1657
localized/zh-cn/1658
localized/zh-cn/1659
localized/zh-cn/1669
localized/zh-cn/1728
localized/zh-cn/1753
localized/zh-cn/1805
localized/zh-cn/19
localized/zh-cn/2
localized/zh-cn/2222
localized/zh-cn/2223
localized/zh-cn/2224
localized/zh-cn/2225
localized/zh-cn/2226
localized/zh-cn/2227
localized/zh-cn/2228
localized/zh-cn/2229
localized/zh-cn/2230
localized/zh-cn/2231
localized/zh-cn/2232
localized/zh-cn/2266
localized/zh-cn/2273
localized/zh-cn/2291
localized/zh-cn/2292
localized/zh-cn/23
localized/zh-cn/2324
localized/zh-cn/2382
localized/zh-cn/2383
localized/zh-cn/2384
localized/zh-cn/24
localized/zh-cn/254
localized/zh-cn/255
localized/zh-cn/256
localized/zh-cn/257
localized/zh-cn/258
localized/zh-cn/2597
localized/zh-cn/2598
localized/zh-cn/2599
localized/zh-cn/26
localized/zh-cn/2600
localized/zh-cn/2601
localized/zh-cn/2602
localized/zh-cn/2603
localized/zh-cn/2604
localized/zh-cn/2605
localized/zh-cn/2606
localized/zh-cn/2607
localized/zh-cn/2608
localized/zh-cn/2609
localized/zh-cn/2610
localized/zh-cn/2611
localized/zh-cn/2619
localized/zh-cn/262
localized/zh-cn/2620
localized/zh-cn/264
localized/zh-cn/2673
localized/zh-cn/2697
localized/zh-cn/2698
localized/zh-cn/27
localized/zh-cn/2705
localized/zh-cn/2715
localized/zh-cn/2724
localized/zh-cn/28
localized/zh-cn/2805
localized/zh-cn/2806
localized/zh-cn/2807
localized/zh-cn/2808
localized/zh-cn/2810
localized/zh-cn/2812
localized/zh-cn/2859
localized/zh-cn/3
localized/zh-cn/330
localized/zh-cn/34
localized/zh-cn/35
localized/zh-cn/358
localized/zh-cn/36
localized/zh-cn/361
localized/zh-cn/4
localized/zh-cn/408
localized/zh-cn/5
localized/zh-cn/6
localized/zh-cn/644
localized/zh-cn/645
localized/zh-cn/646
localized/zh-cn/647
localized/zh-cn/649
localized/zh-cn/663
localized/zh-cn/664
localized/zh-cn/665
localized/zh-cn/7
localized/zh-cn/720
localized/zh-cn/739
localized/zh-cn/799
localized/zh-cn/8
localized/zh-cn/800
localized/zh-cn/9
localized/zh-tw/1
localized/zh-tw/10
localized/zh-tw/1068
localized/zh-tw/1069
localized/zh-tw/1070
localized/zh-tw/1071
localized/zh-tw/1076
localized/zh-tw/1077
localized/zh-tw/1078
localized/zh-tw/1080
localized/zh-tw/1093
localized/zh-tw/11
localized/zh-tw/12
localized/zh-tw/13
localized/zh-tw/14
localized/zh-tw/1653
localized/zh-tw/1654
localized/zh-tw/1655
localized/zh-tw/1656
localized/zh-tw/1657
localized/zh-tw/1658
localized/zh-tw/1659
localized/zh-tw/1669
localized/zh-tw/1728
localized/zh-tw/1753
localized/zh-tw/1805
localized/zh-tw/19
localized/zh-tw/2
localized/zh-tw/2222
localized/zh-tw/2223
localized/zh-tw/2224
localized/zh-tw/2225
localized/zh-tw/2226
localized/zh-tw/2227
localized/zh-tw/2228
localized/zh-tw/2229
localized/zh-tw/2230
localized/zh-tw/2231
localized/zh-tw/2232
localized/zh-tw/2266
localized/zh-tw/2273
localized/zh-tw/2291
localized/zh-tw/2292
localized/zh-tw/23
localized/zh-tw/2324
localized/zh-tw/2382
localized/zh-tw/2383
localized/zh-tw/2384
localized/zh-tw/24
localized/zh-tw/254
localized/zh-tw/255
localized/zh-tw/256
localized/zh-tw/257
localized/zh-tw/258
localized/zh-tw/2597
localized/zh-tw/2598
localized/zh-tw/2599
localized/zh-tw/26
localized/zh-tw/2600
localized/zh-tw/2601
localized/zh-tw/2602
localized/zh-tw/2603
localized/zh-tw/2604
localized/zh-tw/2605
localized/zh-tw/2606
localized/zh-tw/2607
localized/zh-tw/2608
localized/zh-tw/2609
localized/zh-tw/2610
localized/zh-tw/2611
localized/zh-tw/2619
localized/zh-tw/262
localized/zh-tw/2620
localized/zh-tw/264
localized/zh-tw/2673
localized/zh-tw/2697
localized/zh-tw/2698
localized/zh-tw/27
localized/zh-tw/2705
localized/zh-tw/2715
localized/zh-tw/2724
localized/zh-tw/28
localized/zh-tw/2805
localized/zh-tw/2806
localized/zh-tw/2807
localized/zh-tw/2808
localized/zh-tw/2810
localized/zh-tw/2812
localized/zh-tw/2859
localized/zh-tw/3
localized/zh-tw/330
localized/zh-tw/34
localized/zh-tw/35
localized/zh-tw/358
localized/zh-tw/36
localized/zh-tw/361
localized/zh-tw/4
localized/zh-tw/408
localized/zh-tw/5
localized/zh-tw/6
localized/zh-tw/644
localized/zh-tw/645
localized/zh-tw/646
localized/zh-tw/647
localized/zh-tw/649
localized/zh-tw/663
localized/zh-tw/664
localized/zh-tw/665
localized/zh-tw/7
localized/zh-tw/720
localized/zh-tw/739
localized/zh-tw/799
localized/zh-tw/8
localized/zh-tw/800
localized/zh-tw/9
package.xml
Windows6.1-KB3063858-x86-pkgProperties.txt
Windows6.1-KB3063858-x86.cab
.cab
0
1
10
11
12
13
14
15
16
17
18
19
2
20
21
22
23
24
25
26
27
28
29
3
30
31
32
33
34
35
36
37
38
39
4
40
41
42
43
44
45
46
47
48
49
5
50
51
52
53
54
55
56
57
58
59
6
60
61
62
63
7
8
9
_manifest_.cix.xml
.xml
package_1_for_kb3063858_bf~31bf3856ad364e35~x86~~6.1.1.0.cat
package_1_for_kb3063858_bf~31bf3856ad364e35~x86~~6.1.1.0.mum
.xml
package_1_for_kb3063858~31bf3856ad364e35~x86~~6.1.1.0.cat
package_1_for_kb3063858~31bf3856ad364e35~x86~~6.1.1.0.mum
.xml
package_2_for_kb3063858_bf~31bf3856ad364e35~x86~~6.1.1.0.cat
package_2_for_kb3063858_bf~31bf3856ad364e35~x86~~6.1.1.0.mum
.xml
package_2_for_kb3063858~31bf3856ad364e35~x86~~6.1.1.0.cat
package_2_for_kb3063858~31bf3856ad364e35~x86~~6.1.1.0.mum
.xml
package_3_for_kb3063858_bf~31bf3856ad364e35~x86~~6.1.1.0.cat
package_3_for_kb3063858_bf~31bf3856ad364e35~x86~~6.1.1.0.mum
.xml
package_3_for_kb3063858~31bf3856ad364e35~x86~~6.1.1.0.cat
package_3_for_kb3063858~31bf3856ad364e35~x86~~6.1.1.0.mum
.xml
package_4_for_kb3063858_bf~31bf3856ad364e35~x86~~6.1.1.0.cat
package_4_for_kb3063858_bf~31bf3856ad364e35~x86~~6.1.1.0.mum
.xml
package_4_for_kb3063858~31bf3856ad364e35~x86~~6.1.1.0.cat
package_4_for_kb3063858~31bf3856ad364e35~x86~~6.1.1.0.mum
.xml
package_for_kb3063858_rtm_bf~31bf3856ad364e35~x86~~6.1.1.0.cat
package_for_kb3063858_rtm_bf~31bf3856ad364e35~x86~~6.1.1.0.mum
.xml
package_for_kb3063858_rtm~31bf3856ad364e35~x86~~6.1.1.0.cat
package_for_kb3063858_rtm~31bf3856ad364e35~x86~~6.1.1.0.mum
.xml
package_for_kb3063858_sp1_bf~31bf3856ad364e35~x86~~6.1.1.0.cat
package_for_kb3063858_sp1_bf~31bf3856ad364e35~x86~~6.1.1.0.mum
.xml
package_for_kb3063858_sp1~31bf3856ad364e35~x86~~6.1.1.0.cat
package_for_kb3063858_sp1~31bf3856ad364e35~x86~~6.1.1.0.mum
.xml
update-bf.cat
update-bf.mum
.xml
update.cat
update.mum
x86_0026481a85b9b15e0e0f83de02ffd0d8_31bf3856ad364e35_6.1.7601.18847_none_00bbb034f417c32e.manifest
.xml
x86_239360895b93c9ae9583d01d6cf2cddd_31bf3856ad364e35_6.1.7601.23049_none_dfbd8f4f8ae633b1.manifest
.xml
x86_4d209694a6d926128a454bde874c02fc_31bf3856ad364e35_6.1.7601.23049_none_c9865dffe36e7789.manifest
.xml
x86_686f65cbb08f0b0bbf3ac3e40e69f74e_31bf3856ad364e35_6.1.7601.18847_none_bb94433f804dd07f.manifest
.xml
x86_a5bee88dd94c0c6288eb166dce47b7cd_31bf3856ad364e35_6.1.7601.23049_none_be48aa377c1f9158.manifest
.xml
x86_a5ddc9dc59dc06b13ec8f6e42de39319_31bf3856ad364e35_6.1.7601.18847_none_31b52da7a1df2749.manifest
.xml
x86_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.18847_none_7645b14060718fac.manifest
.xml
x86_microsoft-windows-consolehost_31bf3856ad364e35_6.1.7601.23049_none_76d126c1798d9566.manifest
.xml
x86_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.18847_none_95a7cf30b4a352a7.manifest
.xml
x86_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.23049_none_963344b1cdbf5861.manifest
.xml
x86_microsoft-windows-kernelbase_31bf3856ad364e35_6.1.7601.18847_none_28ec624312ebda93.manifest
.xml
x86_microsoft-windows-kernelbase_31bf3856ad364e35_6.1.7601.23049_none_2977d7c42c07e04d.manifest
.xml
x86_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_6.1.7601.18847_none_0c9bd9e5da27bd35.manifest
.xml
x86_microsoft-windows-minkernelapinamespace_31bf3856ad364e35_6.1.7601.23049_none_0d274f66f343c2ef.manifest
.xml
x86_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.18847_none_b8688091faacffa4.manifest
.xml
x86_microsoft-windows-winsrv_31bf3856ad364e35_6.1.7601.23049_none_b8f3f61313c9055e.manifest
.xml
Windows6.1-KB3063858-x86.xml
.xml
plugins/winpcap/x64/Packet.dll
.dll windows:4 windows x64 arch:x64

c6f10f7d059cc60c2062dce08fd9f184

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

14:02:ae:ef:0d:31:be:74:3e:73:f6:a7:a9:60:c4:f4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26/09/2012, 00:00

Not After

27/10/2015, 23:59

Subject

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

e4:78:ac:b5:8e:39:ff:29:c5:f7:dd:4c:a9:16:23:df:19:4e:49:bc
Signer

Actual PE Digest

e4:78:ac:b5:8e:39:ff:29:c5:f7:dd:4c:a9:16:23:df:19:4e:49:bc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\releases\winpcap_4_1_3\winpcap\packetNtx\Dll\Project\Release No NetMon\x64\Packet.pdb

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

ws2_32

inet_addr

iphlpapi

GetAdaptersInfo

kernel32

GlobalAlloc
SetEvent
CreateEventW
GetModuleHandleW
WriteFile
DeviceIoControl
GetSystemDirectoryW
WideCharToMultiByte
LoadLibraryW
QueryPerformanceFrequency
CloseHandle
GlobalFree
ReadFile
GetVersion
GetModuleFileNameW
MultiByteToWideChar
CreateFileA
CreateMutexW
GetLastError
SetLastError
GetProcAddress
QueryPerformanceCounter
ReleaseMutex
GlobalUnlock
WaitForSingleObject
GlobalLock
GlobalHandle
HeapSize
FlushFileBuffers
GetFullPathNameW
RtlVirtualUnwind
GetCurrentThreadId
FlsSetValue
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlCaptureContext
RtlLookupFunctionEntry
GetModuleHandleA
ExitProcess
FlsGetValue
TlsFree
FlsFree
TlsSetValue
FlsAlloc
Sleep
HeapSetInformation
HeapCreate
HeapDestroy
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
RtlUnwindEx
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSection
HeapReAlloc
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA

advapi32

QueryServiceStatus
StartServiceW
CloseServiceHandle
OpenServiceA
RegOpenKeyExA
ControlService
CreateServiceA
RegQueryValueExW
RegQueryValueExA
RegCloseKey
RegEnumKeyW
RegOpenKeyExW
OpenSCManagerW

Exports

Exports

PacketAllocatePacket
PacketCloseAdapter
PacketFreePacket
PacketGetAdapterNames
PacketGetAirPcapHandle
PacketGetDriverVersion
PacketGetNetInfoEx
PacketGetNetType
PacketGetReadEvent
PacketGetStats
PacketGetStatsEx
PacketGetVersion
PacketInitPacket
PacketIsDumpEnded
PacketLibraryVersion
PacketOpenAdapter
PacketReceivePacket
PacketRequest
PacketSendPacket
PacketSendPackets
PacketSetBpf
PacketSetBuff
PacketSetDumpLimits
PacketSetDumpName
PacketSetHwFilter
PacketSetLoopbackBehavior
PacketSetMinToCopy
PacketSetMode
PacketSetNumWrites
PacketSetReadTimeout
PacketSetSnapLen
PacketStopDriver

Sections

.text
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 738B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/winpcap/x64/wpcap.dll
.dll windows:4 windows x64 arch:x64

dbf5d5d07c8769586600cbb0149f95a8

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

14:02:ae:ef:0d:31:be:74:3e:73:f6:a7:a9:60:c4:f4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26/09/2012, 00:00

Not After

27/10/2015, 23:59

Subject

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

35:26:39:1b:a3:b4:ad:b6:b0:9f:7e:f3:21:f4:bd:2e:84:9a:39:e5
Signer

Actual PE Digest

35:26:39:1b:a3:b4:ad:b6:b0:9f:7e:f3:21:f4:bd:2e:84:9a:39:e5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\releases\winpcap_4_1_3\winpcap\wpcap\PRJ\Release\x64\wpcap.pdb

Imports

ws2_32

shutdown
ntohs
getservbyname
htonl
inet_addr
getservbyport
inet_ntoa
gethostbyname
gethostbyaddr
htons
WSAGetLastError
WSASetLastError
getprotobyname
accept
closesocket
getpeername
getsockopt
setsockopt
getsockname
select
WSAStartup
connect
listen
send
socket
bind
recv
ntohl
WSACleanup

packet

PacketGetAdapterNames
PacketGetNetInfoEx
PacketSetLoopbackBehavior
PacketSetMinToCopy
PacketSendPacket
PacketSetReadTimeout
PacketReceivePacket
PacketSetMode
PacketInitPacket
PacketOpenAdapter
PacketSetBpf
PacketAllocatePacket
PacketCloseAdapter
PacketFreePacket
PacketGetNetType
PacketSetBuff
PacketSetHwFilter
PacketGetStats
PacketGetVersion
PacketSetDumpName
PacketSendPackets
PacketIsDumpEnded
PacketGetReadEvent
PacketSetDumpLimits
PacketGetAirPcapHandle
PacketGetStatsEx

kernel32

HeapFree
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
ReadFile
MultiByteToWideChar
FlushFileBuffers
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
HeapSize
SetFilePointer
CloseHandle
HeapDestroy
HeapCreate
HeapSetInformation
FlsAlloc
TlsSetValue
FlsFree
TlsFree
FlsGetValue
IsValidCodePage
GetOEMCP
GetACP
GetCPInfo
GetModuleFileNameA
WriteFile
RtlLookupFunctionEntry
RtlVirtualUnwind
GetLastError
LoadLibraryA
LeaveCriticalSection
GetSystemDirectoryA
FreeLibrary
GetProcAddress
EnterCriticalSection
GetVersion
FindFirstFileA
FindClose
FindNextFileA
FormatMessageA
Sleep
SetLastError
InitializeCriticalSection
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlCaptureContext
HeapAlloc
RtlUnwindEx
SetStdHandle
GetFileType
HeapReAlloc
GetModuleHandleA
ExitProcess
GetCurrentThreadId
FlsSetValue
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
SetHandleCount
GetStdHandle
GetStartupInfoA
DeleteCriticalSection

Exports

Exports

bpf_dump
bpf_filter
bpf_image
bpf_validate
endservent
eproto_db
getservent
install_bpf_program
pcap_activate
pcap_breakloop
pcap_close
pcap_compile
pcap_compile_nopcap
pcap_create
pcap_createsrcstr
pcap_datalink
pcap_datalink_name_to_val
pcap_datalink_val_to_description
pcap_datalink_val_to_name
pcap_dispatch
pcap_dump
pcap_dump_close
pcap_dump_file
pcap_dump_flush
pcap_dump_ftell
pcap_dump_open
pcap_file
pcap_fileno
pcap_findalldevs
pcap_findalldevs_ex
pcap_free_datalinks
pcap_freealldevs
pcap_freecode
pcap_get_airpcap_handle
pcap_geterr
pcap_getevent
pcap_getnonblock
pcap_hopen_offline
pcap_is_swapped
pcap_lib_version
pcap_list_datalinks
pcap_live_dump
pcap_live_dump_ended
pcap_lookupdev
pcap_lookupnet
pcap_loop
pcap_major_version
pcap_minor_version
pcap_next
pcap_next_etherent
pcap_next_ex
pcap_offline_filter
pcap_offline_read
pcap_open
pcap_open_dead
pcap_open_live
pcap_open_offline
pcap_parsesrcstr
pcap_perror
pcap_read
pcap_remoteact_accept
pcap_remoteact_cleanup
pcap_remoteact_close
pcap_remoteact_list
pcap_sendpacket
pcap_sendqueue_alloc
pcap_sendqueue_destroy
pcap_sendqueue_queue
pcap_sendqueue_transmit
pcap_set_buffer_size
pcap_set_datalink
pcap_set_promisc
pcap_set_snaplen
pcap_set_timeout
pcap_setbuff
pcap_setdirection
pcap_setfilter
pcap_setmintocopy
pcap_setmode
pcap_setnonblock
pcap_setsampling
pcap_setuserbuffer
pcap_snapshot
pcap_stats
pcap_stats_ex
pcap_strerror
wsockinit

Sections

.text
Size: 238KB - Virtual size: 238KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 91KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/winpcap/x86/Packet.dll
.dll windows:4 windows x86 arch:x86

03172bdfc03352fe867a35a4bdcb1444

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

14:02:ae:ef:0d:31:be:74:3e:73:f6:a7:a9:60:c4:f4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26/09/2012, 00:00

Not After

27/10/2015, 23:59

Subject

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4f:fa:6c:ae:f9:09:d1:8d:20:28:be:73:5f:c5:42:45:12:03:65:bc
Signer

Actual PE Digest

4f:fa:6c:ae:f9:09:d1:8d:20:28:be:73:5f:c5:42:45:12:03:65:bc

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\releases\winpcap_4_1_3\winpcap\packetNtx\Dll\Project\Release No NetMon\x86\Packet.pdb

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ws2_32

inet_addr

iphlpapi

GetAdaptersInfo

kernel32

GlobalUnlock
GetFullPathNameW
MultiByteToWideChar
GetLastError
CreateFileA
SetLastError
GetProcAddress
CreateMutexW
CreateEventW
QueryPerformanceCounter
DeviceIoControl
WaitForSingleObject
GetModuleHandleW
WriteFile
QueryPerformanceFrequency
CloseHandle
GetVersion
GetSystemDirectoryW
WideCharToMultiByte
LoadLibraryW
ReadFile
GetModuleFileNameW
GlobalLock
ReleaseMutex
GlobalHandle
GlobalAlloc
GlobalFree
HeapSize
FlushFileBuffers
SetEvent
ExitProcess
GetCurrentThreadId
GetCommandLineA
HeapFree
GetVersionExA
HeapAlloc
GetProcessHeap
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleA
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
InterlockedDecrement
Sleep
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapDestroy
HeapCreate
VirtualFree
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSection
VirtualAlloc
HeapReAlloc
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA

advapi32

ControlService
OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
OpenServiceA
StartServiceW
RegOpenKeyExA
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
RegQueryValueExA
RegEnumKeyW
CreateServiceA

Exports

Exports

PacketAllocatePacket
PacketCloseAdapter
PacketFreePacket
PacketGetAdapterNames
PacketGetAirPcapHandle
PacketGetDriverVersion
PacketGetNetInfoEx
PacketGetNetType
PacketGetReadEvent
PacketGetStats
PacketGetStatsEx
PacketGetVersion
PacketInitPacket
PacketIsDumpEnded
PacketLibraryVersion
PacketOpenAdapter
PacketReceivePacket
PacketRequest
PacketSendPacket
PacketSendPackets
PacketSetBpf
PacketSetBuff
PacketSetDumpLimits
PacketSetDumpName
PacketSetHwFilter
PacketSetLoopbackBehavior
PacketSetMinToCopy
PacketSetMode
PacketSetNumWrites
PacketSetReadTimeout
PacketSetSnapLen
PacketStopDriver

Sections

.text
Size: 56KB - Virtual size: 52KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/winpcap/x86/WinProtocolFilter.dll
.dll windows:5 windows x86 arch:x86

1230db9caa72adbf26a023d2be297cfe

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fb:1a:37:f4:4d:5f:88:0e:5e:3f:eb:90:da:26:54:70:8b:58:0c:02:2e:cc:11:e2:76:13:61:e7:7d:f2:32:ee
Signer

Actual PE Digest

fb:1a:37:f4:4d:5f:88:0e:5e:3f:eb:90:da:26:54:70:8b:58:0c:02:2e:cc:11:e2:76:13:61:e7:7d:f2:32:ee

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\Nsec\Release\Client\WinProtocolFilter.pdb

Imports

kernel32

SleepEx
GetModuleHandleW
DeleteCriticalSection
GetProcAddress
QueueUserAPC
ResetEvent
LoadLibraryW
CloseHandle
GetTickCount
GetModuleFileNameA
GetFileSizeEx
WriteFile
OutputDebugStringA
GetCurrentThreadId
CreateFileA
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
SetFilePointerEx
GetCurrentProcessId
GetStartupInfoW
HeapFree
SetLastError
GetCurrentProcess
TerminateProcess
WaitForSingleObjectEx
FindClose
CreateFileW
GetModuleHandleA
OpenProcess
HeapAlloc
LocalFree
GetProcessHeap
FreeLibrary
LoadLibraryExW
MultiByteToWideChar
WideCharToMultiByte
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwind
RaiseException
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetACP
GetStdHandle
GetFileType
GetStringTypeW
LCMapStringW
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
HeapSize
HeapReAlloc
GetConsoleCP
GetConsoleMode
FlushFileBuffers
DecodePointer
WriteConsoleW
SetEvent
GetLastError
CreateEventW
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection

advapi32

GetTokenInformation
ConvertSidToStringSidW
RegQueryValueExW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
OpenProcessToken

shlwapi

wvnsprintfA
SHSetValueA
PathFindFileNameA
wnsprintfA
PathAppendW
wnsprintfW

ws2_32

ntohs

user32

wsprintfA

shell32

SHCreateDirectoryExA
SHGetSpecialFolderPathW

Exports

Exports

CreateNxPacketHelper
GetNxAdapterNameList
GetNxWinEthernetFilter
StartNxWinEthernetFilter
StopNxWinEthernetFilter

Sections

.text
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/winpcap/x86/wpcap.dll
.dll windows:4 windows x86 arch:x86

10dce091d63eed72dc0010ebc8838f6a

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2011, 19:25

Not After

22/02/2021, 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

14:02:ae:ef:0d:31:be:74:3e:73:f6:a7:a9:60:c4:f4
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

26/09/2012, 00:00

Not After

27/10/2015, 23:59

Subject

CN=Riverbed Technology\, Inc.,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Product Marketing,O=Riverbed Technology\, Inc.,L=San Francisco,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

cf:62:51:f0:27:45:ec:8f:43:5a:c8:f8:39:3a:ab:b8:9f:42:52:b7
Signer

Actual PE Digest

cf:62:51:f0:27:45:ec:8f:43:5a:c8:f8:39:3a:ab:b8:9f:42:52:b7

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

c:\releases\winpcap_4_1_3\winpcap\wpcap\PRJ\Release\x86\wpcap.pdb

Imports

ws2_32

WSACleanup
ntohl
gethostbyname
htons
gethostbyaddr
WSAGetLastError
htonl
getservbyname
inet_addr
getservbyport
inet_ntoa
WSASetLastError
getprotobyname
accept
closesocket
getpeername
getsockopt
setsockopt
getsockname
select
WSAStartup
shutdown
connect
listen
send
socket
bind
ntohs
recv

packet

PacketGetNetInfoEx
PacketGetAdapterNames
PacketSetMinToCopy
PacketSetLoopbackBehavior
PacketSetHwFilter
PacketGetStats
PacketSendPacket
PacketSetReadTimeout
PacketReceivePacket
PacketSetMode
PacketOpenAdapter
PacketSetBpf
PacketAllocatePacket
PacketInitPacket
PacketCloseAdapter
PacketFreePacket
PacketGetNetType
PacketSetBuff
PacketGetVersion
PacketSetDumpName
PacketSendPackets
PacketIsDumpEnded
PacketGetReadEvent
PacketSetDumpLimits
PacketGetAirPcapHandle
PacketGetStatsEx

kernel32

SetUnhandledExceptionFilter
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
CreateFileA
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
ReadFile
MultiByteToWideChar
FlushFileBuffers
GetConsoleMode
GetConsoleCP
WideCharToMultiByte
HeapSize
SetFilePointer
CloseHandle
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
GetModuleFileNameA
WriteFile
DeleteCriticalSection
GetLastError
GetSystemDirectoryA
FreeLibrary
GetProcAddress
EnterCriticalSection
LoadLibraryA
LeaveCriticalSection
GetVersion
FindNextFileA
FormatMessageA
FindFirstFileA
FindClose
InterlockedExchange
SetLastError
InterlockedCompareExchange
Sleep
InitializeCriticalSection
UnhandledExceptionFilter
HeapFree
HeapAlloc
RtlUnwind
SetStdHandle
GetFileType
HeapReAlloc
GetModuleHandleA
ExitProcess
GetCurrentThreadId
GetCommandLineA
GetVersionExA
GetProcessHeap
TerminateProcess
GetCurrentProcess
IsDebuggerPresent
SetHandleCount
GetStdHandle
GetStartupInfoA

Exports

Exports

bpf_dump
bpf_filter
bpf_image
bpf_validate
endservent
eproto_db
getservent
install_bpf_program
pcap_activate
pcap_breakloop
pcap_close
pcap_compile
pcap_compile_nopcap
pcap_create
pcap_createsrcstr
pcap_datalink
pcap_datalink_name_to_val
pcap_datalink_val_to_description
pcap_datalink_val_to_name
pcap_dispatch
pcap_dump
pcap_dump_close
pcap_dump_file
pcap_dump_flush
pcap_dump_ftell
pcap_dump_open
pcap_file
pcap_fileno
pcap_findalldevs
pcap_findalldevs_ex
pcap_free_datalinks
pcap_freealldevs
pcap_freecode
pcap_get_airpcap_handle
pcap_geterr
pcap_getevent
pcap_getnonblock
pcap_hopen_offline
pcap_is_swapped
pcap_lib_version
pcap_list_datalinks
pcap_live_dump
pcap_live_dump_ended
pcap_lookupdev
pcap_lookupnet
pcap_loop
pcap_major_version
pcap_minor_version
pcap_next
pcap_next_etherent
pcap_next_ex
pcap_offline_filter
pcap_offline_read
pcap_open
pcap_open_dead
pcap_open_live
pcap_open_offline
pcap_parsesrcstr
pcap_perror
pcap_read
pcap_remoteact_accept
pcap_remoteact_cleanup
pcap_remoteact_close
pcap_remoteact_list
pcap_sendpacket
pcap_sendqueue_alloc
pcap_sendqueue_destroy
pcap_sendqueue_queue
pcap_sendqueue_transmit
pcap_set_buffer_size
pcap_set_datalink
pcap_set_promisc
pcap_set_snaplen
pcap_set_timeout
pcap_setbuff
pcap_setdirection
pcap_setfilter
pcap_setmintocopy
pcap_setmode
pcap_setnonblock
pcap_setsampling
pcap_setuserbuffer
pcap_snapshot
pcap_stats
pcap_stats_ex
pcap_strerror
wsockinit

Sections

.text
Size: 160KB - Virtual size: 158KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
plugins/xphelper/normaliz.dll
.dll windows:6 windows x86 arch:x86

548ea195d9c22d46a848906eaea9ea4a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

normaliz.pdb

Imports

msvcrt

memcpy
memset
_adjust_fdiv
_amsg_exit
_initterm
free
malloc
_XcptFilter
_wcsnicmp

ntdll

RtlNtStatusToDosError
RtlUnwind

kernel32

GetFileSize
MapViewOfFile
CloseHandle
UnmapViewOfFile
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
InterlockedCompareExchange
Sleep
InterlockedExchange
GetStringTypeW
GetProcessHeap
HeapFree
HeapAlloc
GetLastError
SetLastError
DisableThreadLibraryCalls
CreateFileW
GetSystemDirectoryW
CreateFileMappingA

Exports

Exports

IdnToAscii
IdnToNameprepUnicode
IdnToUnicode
IsNormalizedString
NormalizeString

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/Desh64.dll
.dll windows:5 windows x64 arch:x64

977cdfa349f7092b0a6c20e0a9c19c0f

Code Sign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

47:25:7b:9b:df:12:2f:fa:04:0e:87:59:fc:a4:9d:2d:ca:54:55:b3:1b:2c:96:63:1f:10:74:47:be:a2:9c:68
Signer

Actual PE Digest

47:25:7b:9b:df:12:2f:fa:04:0e:87:59:fc:a4:9d:2d:ca:54:55:b3:1b:2c:96:63:1f:10:74:47:be:a2:9c:68

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\x64\Desh64.pdb

Imports

kernel32

CancelIo
QueryDosDeviceW
GetSystemDirectoryA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
WriteFile
SetFileTime
SetFilePointer
SetEndOfFile
WaitForSingleObject
SetFileAttributesW
CreateEventW
GetFileInformationByHandle
GetLastError
DeleteFileW
SetFilePointerEx
MoveFileExW
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetSystemTime
FlushFileBuffers
GetModuleFileNameA
SetLastError
OutputDebugStringA
CreateFileA
GetLocalTime
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
LocalFree
OpenMutexW
GetTickCount
HeapFree
HeapAlloc
SetFileAttributesA
GetProcessHeap
Sleep
GetDriveTypeW
FormatMessageA
DeleteCriticalSection
VerSetConditionMask
SleepEx
VerifyVersionInfoA
FreeLibrary
GetProcAddress
WaitForMultipleObjects
GetFileType
GetStdHandle
PeekNamedPipe
LoadLibraryA
RtlPcToFileHeader
EncodePointer
RaiseException
RtlUnwindEx
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
CreateThread
ExitThread
FreeLibraryAndExitThread
FileTimeToSystemTime
GetConsoleMode
ReadConsoleW
GetACP
GetStringTypeW
CompareStringW
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
HeapReAlloc
GetConsoleCP
SetStdHandle
GetCurrentDirectoryW
GetFullPathNameW
HeapSize
WriteConsoleW
GetTimeZoneInformation
OpenProcess
CloseHandle
CreateFileW
GetFileSizeEx
ReadFile

shlwapi

PathAddBackslashW
StrToIntExA
SHSetValueA
PathGetDriveNumberW
PathIsRootW
PathFindExtensionW
PathIsDirectoryW
wnsprintfW
PathFindFileNameA
wvnsprintfA
wnsprintfA

sfc

SfcIsFileProtected

ws2_32

getaddrinfo
WSAIoctl
setsockopt
ntohs
getsockopt
getsockname
getpeername
bind
send
recv
WSASetLastError
freeaddrinfo
recvfrom
sendto
accept
listen
ioctlsocket
select
__WSAFDIsSet
WSAGetLastError
WSACleanup
WSAStartup
gethostname
closesocket
inet_addr
socket
connect
htons
WSAGetOverlappedResult
WSARecv
WSASend

wldap32

ord32
ord27
ord26
ord22
ord33
ord50
ord60
ord211
ord46
ord143
ord79
ord30
ord200
ord301
ord41
ord35

user32

wsprintfA

advapi32

RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW
OpenProcessToken
ConvertSidToStringSidW
RegQueryValueExW
GetTokenInformation
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
RegCloseKey

shell32

SHCreateDirectoryExA

Exports

Exports

DES_DecryptFile
DES_EncryptFile
DES_IsEncryptedFile
DES_IsKeyMached

Sections

.text
Size: 332KB - Virtual size: 332KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 104KB - Virtual size: 103KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/DtCore64.dll
.dll windows:5 windows x64 arch:x64

d8ed49acffec4d0492ac78ee8f56ef71

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e1:91:1b:f2:f2:e4:32:db:f6:96:f3:d7:74:e1:23:b4:c3:9b:5e:a7:86:f3:41:fa:b1:e9:ca:eb:5e:4b:6e:83
Signer

Actual PE Digest

e1:91:1b:f2:f2:e4:32:db:f6:96:f3:d7:74:e1:23:b4:c3:9b:5e:a7:86:f3:41:fa:b1:e9:ca:eb:5e:4b:6e:83

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\x64\DtCore64.pdb

Imports

kernel32

TlsAlloc
DisableThreadLibraryCalls
TerminateThread
SystemTimeToTzSpecificLocalTime
RtlUnwind
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
CompareFileTime
LoadLibraryW
DeviceIoControl
TlsGetValue
TlsSetValue
GetBinaryTypeW
MoveFileExW
GetFileAttributesExW
SetFileAttributesW
CreateFileW
ReadFile
SleepEx
QueueUserAPC
GlobalUnlock
GetTickCount
GlobalLock
DeleteCriticalSection
TlsFree
MoveFileWithProgressW
CopyFileExW
lstrlenW
OutputDebugStringA
GetExitCodeThread
VirtualFreeEx
GetTempPathW
GetModuleHandleA
GetSystemDirectoryW
DeleteFileW
QueueUserWorkItem
GetFileAttributesW
GetCurrentProcessId
LocalFree
ResetEvent
SetEvent
Sleep
CreateEventW
OpenEventW
GetVolumeInformationA
QueryDosDeviceA
InitializeCriticalSection
GetLogicalDrives
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
LoadLibraryExW
FreeLibrary
GetModuleHandleW
GetProcAddress
CreateFileMappingW
GetFileSize
UnmapViewOfFile
SetFilePointer
WriteFile
VirtualQuery
SetThreadContext
FlushInstructionCache
GetThreadContext
GetCurrentThread
SuspendThread
GetCurrentThreadId
VirtualAlloc
GetCurrentProcess
VirtualFree
VirtualProtect
GetExitCodeProcess
VirtualQueryEx
IsWow64Process
CreateProcessW
ReadProcessMemory
ExitProcess
VirtualAllocEx
CopyFileW
Process32FirstW
Process32NextW
CreateToolhelp32Snapshot
Thread32First
Thread32Next
GetComputerNameW
SetFilePointerEx
CreateDirectoryW
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
SetConsoleCtrlHandler
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
ReadConsoleW
GetCurrentDirectoryW
GetDriveTypeW
GetConsoleMode
GetACP
WriteConsoleW
GetFileType
GetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
InterlockedFlushSList
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetSystemDirectoryA
GetFileSizeEx
VirtualProtectEx
CloseHandle
GetLastError
OpenProcess
ResumeThread
WaitForSingleObject
GetEnvironmentVariableA
GetEnvironmentVariableW
TerminateProcess
SetLastError
CreateFileA
GetLogicalDriveStringsW
LocalAlloc
FindClose
RemoveDirectoryW
lstrcpynW
FindNextFileW
FindFirstFileW
QueryDosDeviceW
ReleaseMutex
GetModuleFileNameA
FileTimeToSystemTime
FlushFileBuffers
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
SwitchToThread
OpenFileMappingW
GetLocalTime
MapViewOfFile
CreateMutexW
OpenMutexW
HeapFree
GetDriveTypeA
HeapAlloc
SetFileAttributesA
GetProcessHeap
GetPrivateProfileStringA
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetVersionExW
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
GetVersionExA
DeleteFileA
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
SystemTimeToFileTime
GetSystemTime
FormatMessageA
WriteProcessMemory

user32

GetUserObjectInformationW
wsprintfA
CharUpperW
GetPropW
wsprintfW
GetWindowDC
PostMessageW
IsWindowVisible
EnumThreadWindows
GetDC
FindWindowW
ReleaseDC
GetMessageW
DispatchMessageA
CallNextHookEx
IsWindow
UnhookWindowsHookEx
DefWindowProcA
CreateWindowExA
TranslateMessage
LoadIconW
LoadCursorW
SetWindowsHookExW
PostQuitMessage
RegisterClassExA
UpdateWindow
GetMenuItemInfoW
InsertMenuItemW
GetMenuItemCount
GetProcessWindowStation
MessageBoxW
TrackPopupMenu
SetMenuItemInfoW
EnableMenuItem
EnumWindows
GetWindowTextA
RealGetWindowClassA
GetClipboardData
mouse_event
GetSystemMetrics
FillRect
DdeGetData
GetWindowLongPtrW
SetWindowLongPtrW
DdeAccessData
GetWindowThreadProcessId
SetClipboardData
EnumChildWindows
SendMessageW
GetWindowTextW

gdi32

Ellipse
GetObjectW
GetStockObject
StretchBlt
BitBlt
SelectObject
CreateCompatibleDC
GetDIBits
DeleteDC

advapi32

CryptGenRandom
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
OpenServiceW
RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
OpenSCManagerW
CloseServiceHandle
QueryServiceStatus
RegCloseKey
SetSecurityDescriptorDacl
GetTokenInformation
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExA
OpenProcessToken
RegSetValueExW
RegCreateKeyExW
RegQueryValueExA
ConvertSidToStringSidA
SetFileSecurityW
CryptEnumProvidersW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
CryptDecrypt

shell32

SHCreateDirectoryExW
CommandLineToArgvW
SHFreeNameMappings
SHFileOperationW
ShellExecuteExW
SHGetPathFromIDListW
SHGetSpecialFolderPathW
SHCreateDirectoryExA
DragQueryFileW

ole32

CoCreateGuid
CoInitializeSecurity
ReleaseStgMedium
CoUninitialize
CoInitialize
OleFlushClipboard
OleGetClipboard
RegisterDragDrop
OleIsCurrentClipboard
OleSetClipboard
CoSetProxyBlanket
CoTaskMemFree
CoCreateInstance

shlwapi

PathFindFileNameW
wnsprintfA
StrStrIA
wnsprintfW
StrStrIW
SHGetValueW
PathRemoveExtensionW
PathAddExtensionW
PathFileExistsW
ord219
PathAppendW
PathFindExtensionW
PathIsNetworkPathW
PathIsDirectoryW
PathMatchSpecW
PathUnquoteSpacesW
StrStrW
PathAppendA
PathFileExistsA
SHSetValueA
SHSetValueW
SHDeleteValueA
PathAddBackslashW
StrToIntExA
PathFindFileNameA
wvnsprintfA

gdiplus

GdipAlloc
GdipGetImageEncoders
GdipCloneImage
GdipDisposeImage
GdipGetImageEncodersSize
GdipSaveImageToFile
GdipFree
GdiplusShutdown
GdipFillEllipseI
GdiplusStartup
GdipCreateBitmapFromFile

ws2_32

shutdown
getnameinfo
connect
closesocket
freeaddrinfo
ioctlsocket
sendto
recvfrom
getpeername
getaddrinfo
gethostname
inet_ntoa
gethostbyname
WSAGetLastError
setsockopt
htons
recv
socket
inet_addr
WSASetLastError
WSACreateEvent
WSACloseEvent
WSAIoctl
bind
send
WSAEnumNetworkEvents
WSAEventSelect
listen
getsockname
getsockopt
ntohs
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

crypt32

CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertOpenSystemStoreW

wldap32

ord142
ord219
ord46
ord14
ord216
ord208
ord41
ord117
ord301
ord147
ord133
ord79
ord145
ord167
ord127
ord27
ord26

Exports

Exports

InstallHook
LdrInjectDll
StartInjectQQOnX86
UnistallHook

Sections

.text
Size: 3.1MB - Virtual size: 3.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 939KB - Virtual size: 938KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 74KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 143KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sharedx
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/NFPCore.dll
.dll windows:5 windows x64 arch:x64

34f5ff73b90a0c369f14b75006adf9b1

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

12:56:c7:8a:f5:02:2e:56:35:38:e2:60:a8:0e:b9:e8:6e:54:9a:45:a1:82:52:cb:7d:14:33:ae:39:47:56:78
Signer

Actual PE Digest

12:56:c7:8a:f5:02:2e:56:35:38:e2:60:a8:0e:b9:e8:6e:54:9a:45:a1:82:52:cb:7d:14:33:ae:39:47:56:78

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\x64\NFPCore.pdb

Imports

kernel32

SystemTimeToTzSpecificLocalTime
SetEvent
CreateEventW
RtlUnwind
DecodePointer
OpenEventW
GetVolumeInformationA
GetFileAttributesW
OpenProcess
GetCurrentThreadId
DeviceIoControl
GetTickCount
GetProcessHeap
HeapAlloc
SetLastError
HeapFree
GetModuleHandleW
GetSystemDirectoryW
DeleteCriticalSection
DisableThreadLibraryCalls
InitializeCriticalSection
GetVersionExW
GetDriveTypeW
SleepEx
GetCurrentProcessId
ReadDirectoryChangesW
QueueUserAPC
CloseHandle
TerminateThread
GetLastError
Sleep
CreateFileW
WaitForSingleObject
LeaveCriticalSection
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
MoveFileExW
CreateDirectoryW
SetStdHandle
GetTimeZoneInformation
GetConsoleCP
EnterCriticalSection
GetLogicalDrives
SetConsoleCtrlHandler
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStringTypeW
GetACP
ReadConsoleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
OpenMutexW
ReadFile
CreateMutexW
LocalFree
SetFileAttributesW
GetDriveTypeA
CreateFileA
SetFileAttributesA
GetModuleFileNameA
GetLocalTime
CreateFileMappingW
MapViewOfFile
DeleteFileA
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
UnmapViewOfFile
HeapValidate
HeapSize
MultiByteToWideChar
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
GetProcAddress
CreateFileMappingA
LockFileEx
GetFileSize
SystemTimeToFileTime
FreeLibrary
WideCharToMultiByte
GetSystemTime
FormatMessageA
FlushFileBuffers
QueryDosDeviceW
FindFirstFileW
FindNextFileW
FindClose
GetModuleHandleA
FileTimeToSystemTime
LoadLibraryExW
GetFileSizeEx
GetSystemDirectoryA
SetFilePointerEx
GetVersion
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
WriteConsoleW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetConsoleMode
GetCurrentDirectoryW

advapi32

RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
RegCloseKey
SetSecurityDescriptorDacl
GetTokenInformation
RegQueryValueExW
SetFileSecurityW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
OpenProcessToken
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize

oleaut32

SysStringLen
SysFreeString
SysAllocString

shlwapi

StrStrIW
SHGetValueW
wnsprintfW
PathFileExistsW
PathAppendW
wnsprintfA
SHSetValueA
PathAddBackslashW
PathFindFileNameA
wvnsprintfA

ws2_32

gethostname
WSACleanup
gethostbyname
WSAStartup
inet_addr
getaddrinfo
socket
inet_ntoa
recvfrom
sendto
setsockopt
WSAGetLastError
freeaddrinfo
connect
WSASetLastError
WSACreateEvent
WSACloseEvent
ioctlsocket
getnameinfo
shutdown
htons
WSAIoctl
listen
bind
gethostbyaddr
htonl
send
WSAEnumNetworkEvents
WSAEventSelect
getpeername
getsockname
getsockopt
ntohs
__WSAFDIsSet
select
closesocket
accept
recv

psapi

EnumProcesses
GetModuleFileNameExW

fltlib

FilterSendMessage
FilterConnectCommunicationPort

crypt32

CertFreeCertificateContext
CertCloseStore
CertDuplicateCertificateContext
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFindCertificateInStore

wldap32

ord117
ord216
ord219
ord46
ord41
ord208
ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord145
ord14

user32

GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
wsprintfA
wsprintfW

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHCreateDirectoryExA

Exports

Exports

AddAccessDenyFile
AddInternalProcess
AddProtectedProcess
AddReadOnlyFile
AddXProcess
DestroyNFPService
FastPing
FsAddInternalProcess
InitNFPService
KnAddInternalProcess
NotifyVolumeChanged
Ping
PsTerminateProcessInKernel
RegisterFileChangedNotifyHandler
RegisterProcessNotifyCallback
RegisterVolumeChangedNotifyHandler
RegisterVolumeChangedNotifyHandler2
ReleaseBypassDrivers
RemoveAccessDenyFile
RemoveReadOnlyFile
RmvProtectedProcess
WindowsFirewallAddAppA
WindowsFirewallAddAppW

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 679KB - Virtual size: 679KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 68KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 121KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/NSOutlookAddin64.dll
.dll regsvr32 windows:5 windows x64 arch:x64

35bcfe624a6f632dcfaabe88e8b0f7b6

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

58:fb:73:43:8e:75:96:bc:e8:e2:0c:a6:83:63:31:41:57:77:16:8c:26:84:ea:51:00:a6:88:8f:5a:c6:c5:e2
Signer

Actual PE Digest

58:fb:73:43:8e:75:96:bc:e8:e2:0c:a6:83:63:31:41:57:77:16:8c:26:84:ea:51:00:a6:88:8f:5a:c6:c5:e2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\x64\NSOutlookAddin64.pdb

Imports

kernel32

RtlUnwind
SystemTimeToTzSpecificLocalTime
GetCurrentProcessId
SetThreadLocale
GetThreadLocale
EncodePointer
DecodePointer
MultiByteToWideChar
FindResourceW
GetModuleFileNameW
LoadLibraryExW
lstrcmpiW
CloseHandle
SizeofResource
LoadResource
Sleep
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateDirectoryW
GlobalMemoryStatus
ConvertThreadToFiber
GetModuleHandleW
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
GetEnvironmentVariableW
ReadConsoleA
LeaveCriticalSection
EnterCriticalSection
GetLastError
RaiseException
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
MoveFileExW
SleepEx
SetStdHandle
GetConsoleCP
SetConsoleCtrlHandler
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
GetProcAddress
FreeLibrary
FindFirstFileExA
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetTimeZoneInformation
GetStringTypeW
GetACP
ReadConsoleW
GetConsoleMode
FreeLibraryAndExitThread
ExitThread
CreateThread
WriteConsoleW
GetFileType
GetStdHandle
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
RtlPcToFileHeader
RtlUnwindEx
SetFilePointerEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
WideCharToMultiByte
LocalFree
GetModuleFileNameA
InitializeCriticalSection
GetTickCount
GetLocalTime
GetLogicalDrives
HeapFree
GetDriveTypeA
GetVolumeInformationA
CreateFileA
HeapAlloc
SetFileAttributesA
GetComputerNameW
GetProcessHeap
GetPrivateProfileStringA
SetFileAttributesW
GetDriveTypeW
ReadFile
CreateMutexW
WaitForSingleObject
WriteFile
DeleteFileA
CreateFileMappingW
MapViewOfFile
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSize
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
FindFirstFileW
SetLastError
FindNextFileW
DeviceIoControl
FindClose
GetModuleHandleA
OpenProcess
CreateEventW
FileTimeToSystemTime
GetFileSizeEx
GetSystemDirectoryA
GetCurrentDirectoryW

user32

FindWindowW
SendMessageW
CharNextW
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
wsprintfA

advapi32

RegQueryValueExW
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
ConvertSidToStringSidW
RegOpenKeyExA
OpenProcessToken
SetSecurityDescriptorDacl
GetTokenInformation
CryptGenRandom
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
SetFileSecurityW
ConvertSidToStringSidA
RegQueryValueExA

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHCreateDirectoryExA

ole32

CoTaskMemFree
CoTaskMemRealloc
StringFromGUID2
CoTaskMemAlloc
CoGetInterfaceAndReleaseStream
CoMarshalInterThreadInterfaceInStream
CoInitializeEx
CoUninitialize
CoCreateInstance
CoCreateGuid

oleaut32

SysFreeString
SysAllocStringLen
UnRegisterTypeLi
RegisterTypeLi
SysAllocString
LoadRegTypeLi
LoadTypeLi
VarUI4FromStr
VariantClear
SysStringLen
VariantInit

shlwapi

wvnsprintfW
StrToIntExA
PathFindFileNameA
SHGetValueW
SHDeleteValueA
PathAppendA
PathFileExistsA
SHSetValueW
SHSetValueA
PathAppendW
wnsprintfA
wnsprintfW
PathFileExistsW
PathFindFileNameW
wvnsprintfA

iphlpapi

GetAdaptersAddresses

netapi32

Netbios

ws2_32

gethostname
ntohs
select
gethostbyname
WSAGetLastError
setsockopt
sendto
recv
connect
ioctlsocket
getnameinfo
shutdown
htons
htonl
listen
socket
inet_addr
WSASetLastError
WSACreateEvent
WSACloseEvent
closesocket
WSAIoctl
bind
recvfrom
send
WSAEnumNetworkEvents
WSAEventSelect
freeaddrinfo
getpeername
getsockname
getsockopt
__WSAFDIsSet
WSACleanup
WSAStartup
accept
inet_ntoa
getaddrinfo

crypt32

CertFreeCertificateContext
CertDuplicateCertificateContext
CertCloseStore
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFindCertificateInStore

wldap32

ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord216
ord14
ord145
ord46
ord219
ord208

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 695KB - Virtual size: 695KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 71KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 124KB - Virtual size: 123KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/NSecRTS.exe
.exe windows:5 windows x64 arch:x64

6c293dd39b5bdfaae4853e65551515cb

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ef:78:ed:ee:96:ca:57:e9:a4:05:39:26:ce:f9:a7:80:9a:07:e4:8c:99:c2:8c:94:d2:92:b1:d3:66:db:fb:c2
Signer

Actual PE Digest

ef:78:ed:ee:96:ca:57:e9:a4:05:39:26:ce:f9:a7:80:9a:07:e4:8c:99:c2:8c:94:d2:92:b1:d3:66:db:fb:c2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\Release\Client\x64\NSecRTS.pdb

Imports

kernel32

SetConsoleCtrlHandler
RemoveDirectoryW
GetModuleFileNameA
WaitForMultipleObjects
GetComputerNameW
UnregisterWaitEx
QueryDepthSList
InterlockedPopEntrySList
VirtualFree
VirtualAlloc
GetThreadTimes
UnregisterWait
RegisterWaitForSingleObject
SetThreadAffinityMask
GetProcessAffinityMask
GetNumaHighestNodeNumber
ChangeTimerQueueTimer
GetLogicalProcessorInformation
GetThreadPriority
SignalObjectAndWait
GetCurrentDirectoryW
SystemTimeToTzSpecificLocalTime
RtlUnwind
SetThreadPriority
LocalAlloc
DecodePointer
RaiseException
InitializeCriticalSectionAndSpinCount
CreateProcessW
QueueUserAPC
OpenProcess
DuplicateHandle
GetCurrentProcess
GetStartupInfoW
ResetEvent
QueueUserWorkItem
GetDriveTypeW
SetFilePointerEx
FileTimeToLocalFileTime
GetDiskFreeSpaceExW
FileTimeToSystemTime
GetSystemDirectoryW
FindClose
FindNextFileW
GetFileSizeEx
FindFirstFileW
GetLogicalDrives
GetVolumeInformationW
CreateEventW
OpenMutexW
GetModuleHandleW
ExitProcess
SetEvent
OpenEventW
GetModuleFileNameW
FlushFileBuffers
SleepEx
TerminateThread
TerminateProcess
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
WideCharToMultiByte
FreeLibrary
SystemTimeToFileTime
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
GetFileSize
LockFileEx
LocalFree
CreateFileMappingA
GetProcAddress
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
GetSystemInfo
CloseHandle
HeapReAlloc
DeleteFileW
DeleteFileA
GetVersionExA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetLastError
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
Sleep
MultiByteToWideChar
HeapSize
HeapValidate
UnmapViewOfFile
GetVersionExW
GetCurrentThreadId
GetFileAttributesW
CreateFileW
WaitForSingleObject
CreateMutexW
GetTempPathW
UnlockFileEx
MoveFileExW
SetFileAttributesW
GetLocalTime
ReleaseMutex
GetFileAttributesExA
Process32FirstW
Process32NextW
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
GetEnvironmentVariableA
CompareFileTime
GetVersion
QueryPerformanceFrequency
CreateDirectoryW
WriteConsoleW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetTimeZoneInformation
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetCurrentThread
GetACP
GetStdHandle
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
InterlockedFlushSList
InterlockedPushEntrySList
RtlPcToFileHeader
RtlUnwindEx
IsWow64Process
CreateTimerQueue
DeleteTimerQueueTimer
CreateTimerQueueTimer
ReleaseSemaphore
OpenFileMappingW
MoveFileExA
GetPrivateProfileStringA
GetDateFormatW
GetWindowsDirectoryW
VirtualProtect
WriteProcessMemory
lstrlenW
SetFileAttributesA
GetSystemDirectoryA
LoadLibraryExW
ReadProcessMemory
GetModuleHandleA
CreateToolhelp32Snapshot
GlobalFree
LoadLibraryW
GetVolumeInformationA
GetDriveTypeA
DeviceIoControl
lstrcpynW
QueryDosDeviceW
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetLocaleInfoW
LCMapStringW
CompareStringW
EncodePointer
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
SwitchToThread
SetLastError
GetStringTypeW
SetEndOfFile
GetFullPathNameA
SetFilePointer
InitializeCriticalSection
LeaveCriticalSection
LockFile
GlobalAlloc
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
GetFullPathNameW
EnterCriticalSection
HeapFree
HeapCreate
TryEnterCriticalSection
ReadFile
AreFileApisANSI

user32

wsprintfA
SendMessageTimeoutW
EnumWindows
MoveWindow
GetWindowRect
BlockInput
MessageBoxW
FindWindowW
DefWindowProcW
DispatchMessageA
DestroyWindow
CreateWindowExW
SendMessageW
RegisterClassExW
TranslateMessage
LoadIconW
LoadCursorW
GetUserObjectInformationW
PostQuitMessage
GetProcessWindowStation
CharUpperW
CharNextW
wsprintfW
GetMessageW

gdi32

GetStockObject

advapi32

EqualSid
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
GetTokenInformation
ConvertSidToStringSidW
InitializeSecurityDescriptor
FreeSid
RegSetValueExA
RegSetValueExW
RegisterServiceCtrlHandlerExW
SetServiceStatus
RegQueryValueExW
CreateServiceW
ChangeServiceConfig2W
DeleteService
StartServiceCtrlDispatcherW
RegCreateKeyExW
UnlockServiceDatabase
LockServiceDatabase
OpenProcessToken
CloseServiceHandle
OpenSCManagerW
StartServiceW
QueryServiceConfigW
ChangeServiceConfigW
OpenServiceW
InitiateSystemShutdownExW
RegCloseKey
RegOpenKeyExA
RegOpenKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCreateKeyExA
SetEntriesInAclW
AllocateAndInitializeSid
RegQueryValueExA
ConvertSidToStringSidA
SetFileSecurityW
AdjustTokenPrivileges
SetSecurityDescriptorDacl
LookupPrivilegeValueW
RegDeleteValueW
CryptGenRandom

shell32

SHCreateDirectoryExW
ShellExecuteExW
SHGetSpecialFolderPathW
SHCreateDirectoryExA

ole32

WriteClassStg
CoCreateGuid
CoInitializeEx
StringFromGUID2
CLSIDFromString
StringFromCLSID
CoUninitialize
CoInitialize
StgCreateDocfile
CoCreateInstance
CoTaskMemFree

oleaut32

SysAllocString
SysFreeString

shlwapi

StrCmpIW
PathFileExistsW
wvnsprintfA
PathFindFileNameW
StrToIntExA
StrCmpNIW
SHEnumKeyExA
SHGetValueW
PathAppendW
wvnsprintfW
wnsprintfA
PathFindFileNameA
wnsprintfW
PathAppendA
SHDeleteValueA
SHSetValueA
PathIsDirectoryA
PathFindExtensionW
StrStrIA
StrStrIW
SHDeleteKeyW
PathFileExistsA
SHSetValueW
SHDeleteValueW
SHGetValueA
PathAddBackslashW
StrToInt64ExA

gdiplus

GdiplusStartup

ws2_32

inet_ntoa
setsockopt
connect
socket
inet_addr
closesocket
WSAIoctl
recv
send
select
bind
accept
__WSAFDIsSet
WSAStartup
WSAWaitForMultipleEvents
WSASetLastError
WSACreateEvent
WSACloseEvent
sendto
recvfrom
freeaddrinfo
getaddrinfo
htonl
WSACleanup
ntohs
getsockopt
htons
shutdown
getnameinfo
ioctlsocket
getpeername
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSAGetLastError
getsockname
gethostbyname
gethostname
listen

netapi32

NetApiBufferFree
NetShareAdd
Netbios
NetShareGetInfo
NetShareDel

iphlpapi

GetAdaptersAddresses
GetAdaptersInfo

mpr

WNetCloseEnum
WNetOpenEnumW
WNetEnumResourceW

mapi32

ord75
ord129
ord135
ord17
ord23
ord59
ord198
ord140
ord21
ord15
ord13
ord11

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

psapi

GetModuleFileNameExW

crypt32

CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertOpenSystemStoreW
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertEnumCertificatesInStore
CertOpenStore
CertFindCertificateInStore
CertCloseStore
CertFreeCertificateContext

dbghelp

MiniDumpWriteDump

setupapi

CM_Disconnect_Machine
CM_Locate_DevNode_ExW
CM_Connect_MachineW
SetupDiGetINFClassW
SetupDiCreateDeviceInfoList
SetupDiOpenClassRegKeyExW
SetupCopyOEMInfW
SetupDiClassNameFromGuidExW
SetupScanFileQueueW
SetupOpenFileQueue
CM_Get_Next_Res_Des_Ex
SetupCloseInfFile
CM_Get_Res_Des_Data_Ex
SetupDiOpenDevRegKey
CM_Reenumerate_DevNode_Ex
SetupCloseFileQueue
SetupDiEnumDriverInfoW
SetupDiSetSelectedDriverW
CM_Get_First_Log_Conf_Ex
SetupDiGetDriverInfoDetailW
CM_Get_Res_Des_Data_Size_Ex
SetupDiBuildDriverInfoList
SetupGetStringFieldW
SetupOpenInfFileW
CM_Free_Res_Des_Handle
SetupDiSetDeviceInstallParamsW
SetupFindFirstLineW
CM_Get_DevNode_Status_Ex
SetupDiGetDriverInstallParamsW
SetupDiDestroyDeviceInfoList
SetupDiDestroyDriverInfoList
SetupDiBuildClassInfoListExW
SetupDiGetClassDescriptionExW
SetupDiCreateDeviceInfoW
SetupDiOpenDeviceInfoW
SetupDiCreateDeviceInfoListExW
SetupDiSetDeviceRegistryPropertyW
CM_Get_DevNode_Status
CM_Enable_DevNode
SetupDiGetDeviceInfoListDetailW
CM_Get_Device_ID_ExW
CM_Disable_DevNode
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW
SetupDiSetClassInstallParamsW
SetupDiCallClassInstaller
SetupDiGetDeviceInstallParamsW
SetupDiGetClassDevsExW
SetupDiGetDeviceInstanceIdW
SetupDiRemoveDevice
SetupDiClassGuidsFromNameExW
CM_Free_Log_Conf_Handle

wldap32

ord167
ord26
ord27
ord127
ord142
ord79
ord133
ord147
ord301
ord41
ord208
ord216
ord14
ord46
ord219
ord145
ord117

Sections

.text
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 81KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 162KB - Virtual size: 161KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/NShellExt64.dll
.dll regsvr32 windows:5 windows x64 arch:x64

cc0b59efdf4113865b6910c0c4885db4

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d7:22:b1:b8:b0:93:0d:e2:52:92:95:5f:51:8b:83:c3:7c:22:da:c2:cc:69:d4:72:db:4b:59:7a:a4:66:7a:e7
Signer

Actual PE Digest

d7:22:b1:b8:b0:93:0d:e2:52:92:95:5f:51:8b:83:c3:7c:22:da:c2:cc:69:d4:72:db:4b:59:7a:a4:66:7a:e7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\x64\NShellExt64.pdb

Imports

kernel32

ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
GetEnvironmentVariableW
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
PeekNamedPipe
GetStdHandle
GetFileType
WaitForMultipleObjects
GetEnvironmentVariableA
ExitThread
QueryPerformanceFrequency
SleepEx
QueueUserAPC
SetFilePointerEx
GetSystemDirectoryA
OpenProcess
GetModuleHandleA
DeviceIoControl
FindNextFileW
FormatMessageA
GetSystemTime
LockFileEx
CreateFileMappingA
GlobalMemoryStatus
GetSystemInfo
GetVersionExA
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapValidate
UnmapViewOfFile
UnlockFileEx
GetFullPathNameA
HeapCreate
TryEnterCriticalSection
AreFileApisANSI
GetModuleFileNameA
DeleteFileA
GetPrivateProfileStringA
GetComputerNameW
SetFileAttributesA
CreateFileA
GetVolumeInformationA
GetDriveTypeA
MoveFileExW
ReleaseMutex
QueryDosDeviceW
MapViewOfFile
CreateFileMappingW
OpenFileMappingW
GetLocalTime
GetExitCodeProcess
CreateProcessW
CreateMutexW
GetDriveTypeW
GetDiskFreeSpaceExW
GetLogicalDrives
OutputDebugStringW
GetCPInfo
GetStringTypeW
LCMapStringW
SwitchToThread
ConvertThreadToFiber
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
HeapCompact
FreeLibraryAndExitThread
GetCommandLineA
GetCommandLineW
VirtualAlloc
VirtualQuery
SetStdHandle
ExitProcess
WriteConsoleW
SetConsoleCtrlHandler
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
EnumSystemLocalesW
GetTimeZoneInformation
GetConsoleCP
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
DecodePointer
SetEnvironmentVariableA
CreateDirectoryW
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
WaitForSingleObjectEx
ResetEvent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
HeapQueryInformation
RtlLookupFunctionEntry
RtlCaptureContext
GetUserDefaultLCID
GetTempFileNameW
GetDiskFreeSpaceW
SearchPathW
GetProfileIntW
GetTempPathW
VerifyVersionInfoW
VerSetConditionMask
GetWindowsDirectoryW
SystemTimeToTzSpecificLocalTime
SetFileAttributesW
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
FindResourceExW
GetCurrentDirectoryW
lstrcpyW
GetCurrentProcess
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindFirstFileW
FindClose
DeleteFileW
SystemTimeToFileTime
VirtualProtect
GetUserDefaultUILanguage
GetLocaleInfoW
lstrcmpA
ResumeThread
SetThreadPriority
CreateEventW
SetEvent
GlobalGetAtomNameW
GlobalFlags
WideCharToMultiByte
LocalReAlloc
LocalAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
CompareStringW
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
GlobalFindAtomW
GlobalAddAtomW
lstrcmpW
GlobalDeleteAtom
GetModuleHandleExW
FreeResource
GetSystemDirectoryW
GetCurrentThreadId
OutputDebugStringA
CopyFileW
FormatMessageW
MulDiv
LocalFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalSize
GlobalAlloc
LockResource
SetLastError
SetThreadLocale
GetThreadLocale
EncodePointer
DisableThreadLibraryCalls
CreateFileW
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileTime
WaitForSingleObject
CreateThread
MultiByteToWideChar
FindResourceW
LoadLibraryExW
lstrcmpiW
SizeofResource
LoadResource
LeaveCriticalSection
EnterCriticalSection
HeapSize
HeapReAlloc
HeapDestroy
LoadLibraryA
GetProcessHeap
HeapFree
HeapAlloc
GetProcAddress
GetVersionExW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryW
OpenMutexW
GetTickCount
CloseHandle
Sleep
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
TerminateThread
RaiseException
GetCurrentProcessId
FreeLibrary
CompareFileTime

user32

GetClassInfoExW
CreateWindowExW
IsWindow
IsMenu
IsChild
DestroyWindow
SetWindowPos
GetWindowPlacement
SetWindowPlacement
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
RegisterClassW
CallWindowProcW
PostMessageW
GetMessageTime
GetMessagePos
PeekMessageW
DispatchMessageW
RegisterWindowMessageW
SystemParametersInfoW
InflateRect
CopyRect
GetSysColor
GetMenuItemInfoW
DestroyMenu
RemoveMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
GetMenuState
GetMenuStringW
GetCursorPos
MessageBoxW
GetWindowRect
AppendMenuW
GetDlgItem
PostThreadMessageW
WaitMessage
GetKeyboardLayout
IsCharLowerW
MapVirtualKeyExW
ToUnicodeEx
GetKeyboardState
CreateAcceleratorTableW
DestroyAcceleratorTable
CopyAcceleratorTableW
LockWindowUpdate
SetMenuDefaultItem
GetDoubleClickTime
ModifyMenuW
RegisterClipboardFormatW
CharUpperBuffW
IsClipboardFormatAvailable
GetUpdateRect
DrawMenuBar
DefWindowProcW
SendMessageW
LoadImageW
SetMenuItemInfoW
SetMenuInfo
InsertMenuW
EnableMenuItem
CreatePopupMenu
CharNextW
GetIconInfo
DrawIconEx
DestroyIcon
SetRect
ReleaseDC
GetDC
GetClassInfoW
IsWindowVisible
IsIconic
GetDlgCtrlID
GetProcessWindowStation
GetUserObjectInformationW
wsprintfA
wsprintfW
SetFocus
GetFocus
GetKeyState
GetCapture
EnableWindow
GetSystemMetrics
SetMenu
TrackPopupMenu
UpdateWindow
SetActiveWindow
GetForegroundWindow
SetForegroundWindow
BeginPaint
EndPaint
ValidateRect
DefFrameProcW
ExitWindowsEx
GetComboBoxInfo
ReuseDDElParam
UnpackDDElParam
RedrawWindow
ScrollWindow
SetScrollPos
GetScrollPos
SetScrollRange
GetScrollRange
ShowScrollBar
SetPropW
GetPropW
RemovePropW
GetWindowTextW
GetWindowTextLengthW
GetClientRect
DefMDIChildProcW
TranslateMDISysAccel
SubtractRect
AdjustWindowRectEx
ScreenToClient
MapWindowPoints
EqualRect
PtInRect
GetWindowLongW
InsertMenuItemW
SetWindowLongW
GetWindowLongPtrW
SetWindowLongPtrW
TranslateAcceleratorW
GetClassLongPtrW
GetParent
GetClassNameW
GetTopWindow
LoadAcceleratorsW
GetLastActivePopup
GetWindow
MonitorFromPoint
UpdateLayeredWindow
UnionRect
SetWindowsHookExW
UnhookWindowsHookEx
DrawIcon
FrameRect
CallNextHookEx
CopyIcon
LoadIconW
SetScrollInfo
GetScrollInfo
WinHelpW
MonitorFromWindow
GetMonitorInfoW
GetKeyNameTextW
MapVirtualKeyW
IsWindowEnabled
GetWindowThreadProcessId
GetSysColorBrush
LoadCursorW
DrawTextW
DrawTextExW
GrayStringW
TabbedTextOutW
GetWindowDC
ClientToScreen
FillRect
IntersectRect
SetCursorPos
SetWindowTextW
GetDesktopWindow
RealChildWindowFromPoint
CheckMenuItem
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
BringWindowToTop
GetSystemMenu
IsZoomed
DrawFrameControl
CopyImage
ShowWindow
MoveWindow
CheckDlgButton
IsDialogMessageW
SendDlgItemMessageA
SetRectEmpty
OffsetRect
GetMessageW
TranslateMessage
GetActiveWindow
PostQuitMessage
CreateDialogIndirectParamW
EndDialog
GetNextDlgTabItem
DrawEdge
DrawStateW
CreateMenu
EmptyClipboard
SetClipboardData
CloseClipboard
OpenClipboard
GetAsyncKeyState
MapDialogRect
SetParent
SetWindowRgn
GetWindowRgn
LoadMenuW
CharUpperW
TrackMouseEvent
InvalidateRect
ShowOwnedPopups
SetCursor
DeleteMenu
SetTimer
KillTimer
DestroyCursor
GetMenu
GetNextDlgGroupItem
SetCapture
ReleaseCapture
WindowFromPoint
DrawFocusRect
IsRectEmpty
MessageBeep
EnableScrollBar
HideCaret
InvertRect
NotifyWinEvent
GetMenuDefaultItem
SetLayeredWindowAttributes
EnumDisplayMonitors
SetClassLongPtrW

gdi32

GetClipBox
ExcludeClipRect
Escape
CreateSolidBrush
CreateRectRgn
CreatePatternBrush
CreatePen
CreateHatchBrush
CreateBitmap
PatBlt
CreateRectRgnIndirect
SetTextColor
SetBkColor
ExtTextOutW
GetObjectW
GetTextExtentPoint32W
CreateFontIndirectW
BitBlt
CreateDCW
CopyMetaFileW
CreateDIBSection
SelectObject
GetDIBits
DeleteObject
DeleteDC
CreateCompatibleDC
GetTextFaceW
GetObjectType
GetPixel
GetStockObject
GetViewportExtEx
GetWindowExtEx
IntersectClipRect
LineTo
PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
ExtSelectClipRgn
SelectPalette
SetBkMode
SetMapMode
SetLayout
GetLayout
SetPolyFillMode
SetROP2
SetTextAlign
MoveToEx
TextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
OffsetViewportOrgEx
OffsetWindowOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
CombineRgn
SetRectRgn
DPtoLP
GetTextMetricsW
EnumFontFamiliesExW
CreatePalette
GetNearestPaletteIndex
GetPaletteEntries
GetSystemPaletteEntries
RealizePalette
GetBkColor
CreateCompatibleBitmap
CreateDIBitmap
EnumFontFamiliesW
GetTextCharsetInfo
SetPixel
StretchBlt
SetDIBColorTable
CreateEllipticRgn
Ellipse
GetTextColor
CreatePolygonRgn
Polygon
Polyline
CreateRoundRectRgn
LPtoDP
Rectangle
GetRgnBox
OffsetRgn
RoundRect
FillRgn
FrameRgn
GetBoundsRect
PtInRegion
ExtFloodFill
SetPaletteEntries
SetPixelV
GetWindowOrgEx
GetViewportOrgEx
GetDeviceCaps

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceConfigW
QueryServiceStatus
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
SetFileSecurityW
RegQueryValueExW
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
SetSecurityDescriptorDacl
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
ConvertSidToStringSidW
RegOpenKeyExA
FreeSid
OpenProcessToken
RegQueryValueExA
EqualSid
ConvertSidToStringSidA
AdjustTokenPrivileges
LookupPrivilegeValueW
DeregisterEventSource
ReportEventW
RegisterEventSourceW
CryptEnumProvidersW
CryptReleaseContext
CryptDestroyKey
CryptGetProvParam
CryptAcquireContextW
CryptGetUserKey
RegCloseKey

shell32

SHAppBarMessage
SHBrowseForFolderW
DragFinish
SHGetDesktopFolder
SHGetSpecialFolderLocation
SHGetPathFromIDListW
SHCreateDirectoryExA
SHGetSpecialFolderPathW
SHCreateDirectoryExW
ShellExecuteW
SHGetFileInfoW
DragQueryFileW
ShellExecuteExW

ole32

IsAccelerator
OleTranslateAccelerator
OleDestroyMenuDescriptor
OleCreateMenuDescriptor
OleLockRunning
RevokeDragDrop
RegisterDragDrop
CoLockObjectExternal
OleGetClipboard
DoDragDrop
CoInitializeEx
CreateStreamOnHGlobal
CoCreateGuid
CoInitialize
CoSetProxyBlanket
CoUninitialize
CoDisconnectObject
OleDuplicateData
StringFromGUID2
CoCreateInstance
ReleaseStgMedium
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc

oleaut32

LoadTypeLi
VarUI4FromStr
SysStringLen
LoadRegTypeLi
SysAllocString
VarBstrFromDate
VariantCopy
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantChangeType
VariantClear
VariantInit
SysAllocStringLen
UnRegisterTypeLi
RegisterTypeLi
SysFreeString

shlwapi

PathFindExtensionW
PathIsUNCW
SHDeleteKeyW
PathMatchSpecW
PathIsDirectoryW
SHGetValueW
SHGetValueA
PathFileExistsW
PathAppendW
wnsprintfW
PathStripToRootW
StrFormatKBSizeW
PathRemoveFileSpecW
wnsprintfA
StrToIntExA
PathIsNetworkPathW
SHDeleteValueW
PathFileExistsA
PathFindFileNameW
SHSetValueA
wvnsprintfW
wvnsprintfA
PathFindFileNameA
StrCmpIW

gdiplus

GdipDrawImageRectI
GdiplusShutdown
GdipCreateFromHDC
GdipCreateBitmapFromHBITMAP
GdipDrawImageI
GdipDeleteGraphics
GdipSetInterpolationMode
GdipAlloc
GdipBitmapLockBits
GdipCreateBitmapFromScan0
GdipCreateBitmapFromStream
GdipGetImagePaletteSize
GdipGetImagePalette
GdipGetImagePixelFormat
GdipGetImageHeight
GdipGetImageWidth
GdipGetImageGraphicsContext
GdipDisposeImage
GdipCloneImage
GdiplusStartup
GdipFree
GdipBitmapUnlockBits

msimg32

TransparentBlt
AlphaBlend

comctl32

DestroyPropertySheetPage
CreatePropertySheetPageW

uxtheme

CloseThemeData
DrawThemeBackground
GetThemeColor
GetCurrentThemeName
OpenThemeData
IsAppThemed
IsThemeBackgroundPartiallyTransparent
GetThemeSysColor
GetThemePartSize
DrawThemeParentBackground
DrawThemeText
GetWindowTheme

winmm

PlaySoundW

ws2_32

WSAStartup
ntohs
getsockopt
getsockname
getpeername
WSAEventSelect
WSAEnumNetworkEvents
send
WSACleanup
__WSAFDIsSet
bind
select
closesocket
WSACloseEvent
WSACreateEvent
WSASetLastError
inet_addr
socket
connect
recv
htons
setsockopt
WSAGetLastError
gethostbyname
inet_ntoa
gethostname
accept
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
WSAIoctl
ioctlsocket
getnameinfo
shutdown

crypt32

CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertDuplicateCertificateContext

wldap32

ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord301
ord26

oleacc

LresultFromObject
CreateStdAccessibleObject
AccessibleObjectFromWindow

imm32

ImmReleaseContext
ImmGetOpenStatus
ImmGetContext

iphlpapi

GetAdaptersAddresses

netapi32

Netbios

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 4.4MB - Virtual size: 4.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 101KB - Virtual size: 146KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 207KB - Virtual size: 206KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 425KB - Virtual size: 424KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/NtDesUtil.dll
.dll regsvr32 windows:6 windows x64 arch:x64

e2002e1933e22eea8e5de28d0f339b8f

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ab:17:eb:c8:cc:29:c0:01:29:e4:9b:3f:86:3b:9f:d2:dc:45:cb:f5:f4:88:1f:58:f0:03:67:b4:4f:96:73:80
Signer

Actual PE Digest

ab:17:eb:c8:cc:29:c0:01:29:e4:9b:3f:86:3b:9f:d2:dc:45:cb:f5:f4:88:1f:58:f0:03:67:b4:4f:96:73:80

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\UM_FESF\x64\Release\NtDesUtil.pdb

Imports

ntdll

NtCreateFile
RtlUnwindEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlPcToFileHeader

kernel32

EncodePointer
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
SizeofResource
FindResourceW
lstrcmpiW
MultiByteToWideChar
GetThreadLocale
SetThreadLocale
DeleteCriticalSection
GetVolumePathNamesForVolumeNameW
CloseHandle
DeviceIoControl
WaitForSingleObject
OpenEventW
FindResourceExW
LockResource
LocalFree
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetStringTypeW
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
WriteConsoleW
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileType
GetStdHandle
GetModuleHandleExW
LCMapStringW
IsDebuggerPresent
OutputDebugStringW
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
InterlockedFlushSList
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
ExitProcess

user32

CharNextW

advapi32

ConvertStringSidToSidW
RegQueryValueExW
GetLengthSid
CopySid
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey

ole32

CoTaskMemRealloc
CoTaskMemAlloc
StringFromGUID2
CoCreateInstance
CoTaskMemFree
CoCreateFreeThreadedMarshaler

oleaut32

SafeArrayGetVartype
SafeArrayCopy
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayDestroy
SafeArrayCreate
SysAllocStringByteLen
SysStringByteLen
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
VarUI4FromStr
SysStringLen
SysFreeString
VariantClear
SysAllocString
SafeArrayGetUBound

Exports

Exports

DllCanUnloadNow
DllGetClassObject
DllInstall
DllRegisterServer
DllUnregisterServer

Sections

.text
Size: 120KB - Virtual size: 119KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 57KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/NtDeshs.exe
.exe windows:5 windows x64 arch:x64

390936990181a52ad97710b30d0efc1d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b0:8d:52:b6:b7:45:98:62:04:46:3f:81:83:6a:6a:94:39:c3:4f:da:90:b0:39:39:1c:89:21:b2:b1:f4:8b:28
Signer

Actual PE Digest

b0:8d:52:b6:b7:45:98:62:04:46:3f:81:83:6a:6a:94:39:c3:4f:da:90:b0:39:39:1c:89:21:b2:b1:f4:8b:28

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\Release\Client\x64\NtDeshs.pdb

Imports

kernel32

MoveFileExW
CopyFileExW
GetFileAttributesW
SetFileAttributesW
GetTickCount
SetLastError
GetCommandLineW
CreateEventW
Sleep
SetEvent
GetCurrentThreadId
CreateThread
GetCurrentProcess
DeleteFileW
CreateMutexW
CloseHandle
WaitForSingleObject
ReleaseMutex
GetCurrentThread
LocalFree
MultiByteToWideChar
FindResourceW
GetModuleHandleW
GetModuleFileNameW
LoadLibraryExW
lstrcmpiW
SizeofResource
LoadResource
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
WriteConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindFirstFileExW
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetACP
GetStdHandle
GetModuleHandleExW
ExitProcess
VirtualQuery
VirtualProtect
VirtualAlloc
GetSystemInfo
RtlUnwindEx
RtlPcToFileHeader
GetLastError
RaiseException
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetProcAddress
FreeLibrary
DecodePointer
OpenProcess
CreateFileW
WideCharToMultiByte
EncodePointer
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
InitializeSListHead
OutputDebugStringW
GetModuleFileNameA
GetFileSizeEx
WriteFile
OutputDebugStringA
CreateFileA
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
SetFilePointerEx
FindNextFileW
FindClose

user32

wsprintfA
CharUpperW
MessageBoxW
LoadStringW
CharNextW
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW

advapi32

GetAclInformation
CopySid
GetLengthSid
GetSidSubAuthority
InitializeSid
AllocateAndInitializeSid
GetSidLengthRequired
EqualSid
IsValidSid
GetTokenInformation
SetThreadToken
RevertToSelf
ConvertSidToStringSidW
CheckTokenMembership
MakeSelfRelativeSD
GetSecurityDescriptorGroup
GetSecurityDescriptorOwner
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
GetSecurityDescriptorLength
GetAce
AddAce
DuplicateToken
RegCloseKey
RegCreateKeyExW
RegDeleteKeyW
RegDeleteValueW
RegEnumKeyExW
RegOpenKeyExW
RegQueryInfoKeyW
RegSetValueExW
ImpersonateSelf
OpenThreadToken
AdjustTokenPrivileges
LookupPrivilegeValueW
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
OpenProcessToken
RegQueryValueExW
CloseServiceHandle
ControlService
CreateServiceW
DeleteService
OpenSCManagerW
OpenServiceW
RegisterServiceCtrlHandlerW
SetServiceStatus
StartServiceCtrlDispatcherW
InitializeAcl

ole32

CoAddRefServerProcess
StringFromGUID2
CoCreateInstance
CoInitializeSecurity
CoTaskMemAlloc
CoTaskMemRealloc
CoTaskMemFree
CoImpersonateClient
CoRevertToSelf
CoUninitialize
CoInitializeEx
CoRegisterClassObject
CoRevokeClassObject
CoResumeClassObjects
CoReleaseServerProcess

oleaut32

UnRegisterTypeLi
RegisterTypeLi
SysAllocString
VarUI4FromStr
LoadRegTypeLi
SysFreeString
SysStringLen
LoadTypeLi

shlwapi

PathFindFileNameA
SHSetValueA
wvnsprintfA
wnsprintfW
wnsprintfA
PathFileExistsW
PathIsNetworkPathW

userenv

UnloadUserProfile

winfscore

FesfUtil2UpdateHeaderExclusive_C
FesfUtil2IsFileFesfEncrypted_C
FesfUtil2UpdateHeaderUnsafe_C
FesfUtil2ReadHeaderExclusive_C
FesfUtil2ReadHeaderUnsafe_C

shell32

SHCreateDirectoryExA

Sections

.text
Size: 294KB - Virtual size: 294KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 132KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/NtDeshs2.dll
.dll windows:5 windows x64 arch:x64

092415070fdbf66a0830e3900dcb03b6

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

df:db:00:1e:98:79:04:72:f3:fb:86:c0:a9:59:95:e5:4d:b8:ee:1c:37:4a:13:64:62:27:9a:75:3b:40:cb:5d
Signer

Actual PE Digest

df:db:00:1e:98:79:04:72:f3:fb:86:c0:a9:59:95:e5:4d:b8:ee:1c:37:4a:13:64:62:27:9a:75:3b:40:cb:5d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\x64\NtDeshs2.pdb

Imports

kernel32

HeapFree
InitializeCriticalSectionAndSpinCount
HeapSize
GetLastError
DisableThreadLibraryCalls
HeapReAlloc
RaiseException
HeapAlloc
DeleteCriticalSection
GetProcessHeap
CreateFileW
WriteConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
CloseHandle
CreateEventW
GetModuleHandleW
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
SetLastError
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
LCMapStringW
FindClose
FindFirstFileExA
FindNextFileA
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStdHandle
GetFileType
GetStringTypeW
SetStdHandle
WriteFile
FlushFileBuffers

winfscore

FesfUtil2IsFileFesfEncrypted_C

Exports

Exports

DesUtilIsEncryptedFile

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/PolicyHandler.dll
.dll windows:5 windows x64 arch:x64

7d259b729dd3df4882f2eb1019804dce

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ae:41:85:4d:61:d0:f9:00:4e:f8:b9:c8:78:14:ce:ce:6b:8b:33:14:a4:ad:dc:fd:09:f7:be:f0:cb:d7:e6:6a
Signer

Actual PE Digest

ae:41:85:4d:61:d0:f9:00:4e:f8:b9:c8:78:14:ce:ce:6b:8b:33:14:a4:ad:dc:fd:09:f7:be:f0:cb:d7:e6:6a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\Nsec\Release\Client\x64\PolicyHandler.pdb

Imports

kernel32

SetEvent
ResetEvent
CreateEventW
OpenProcess
GetCurrentProcess
GetSystemWindowsDirectoryW
ProcessIdToSessionId
WaitForSingleObjectEx
CopyFileW
GetCurrentProcessId
GetLocalTime
GetModuleFileNameW
FreeLibrary
GetProcAddress
LoadLibraryW
GetFileSize
SetWaitableTimer
OutputDebugStringA
MoveFileW
GetTickCount
SleepEx
MoveFileExW
QueueUserAPC
CloseHandle
GetLastError
SetFileAttributesW
GetFileAttributesW
CreateFileW
CreateWaitableTimerW
WaitForSingleObject
SetEndOfFile
InitializeCriticalSection
LeaveCriticalSection
GetVolumeInformationW
LocalFileTimeToFileTime
FileTimeToSystemTime
WriteFile
EnterCriticalSection
GetFileSizeEx
GetLogicalDrives
FileTimeToLocalFileTime
SystemTimeToFileTime
GetSystemTime
FindFirstFileW
FindNextFileW
FindClose
GetModuleHandleW
SystemTimeToTzSpecificLocalTime
GetCurrentDirectoryW
RtlUnwind
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
ReadFile
CreateDirectoryW
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
QueryPerformanceFrequency
WriteConsoleW
SetStdHandle
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
GetFileType
GetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
SetConsoleCtrlHandler
FormatMessageW
WideCharToMultiByte
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
Sleep
DeleteFileW
TerminateThread
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
HeapFree
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
SetFilePointer
GetFullPathNameA
UnlockFileEx
GetTempPathW
CreateMutexW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
GetVersionExA
DeleteFileA
HeapReAlloc
GetSystemInfo
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LocalFree
LockFileEx
GetProcessHeap
FormatMessageA
CreateFileMappingW
MapViewOfFile
FlushFileBuffers
OpenFileMappingW
QueryDosDeviceW
ReleaseMutex
RaiseException
GetDiskFreeSpaceExW
GetDriveTypeW
MoveFileExA
GetDriveTypeA
GetVolumeInformationA
SetFileAttributesA
GetComputerNameW
GetPrivateProfileStringA
CreatePipe
GetSystemDirectoryW
CreateProcessW
OpenMutexW
GetExitCodeProcess
SizeofResource
LockResource
LoadResource
FindResourceW
LoadLibraryExW
GetModuleFileNameA
lstrcpynW
DeviceIoControl
RemoveDirectoryW
LocalAlloc
GetModuleHandleA
FreeResource
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
ReadProcessMemory
lstrlenW
GetSystemDirectoryA
SetFilePointerEx
CreateTimerQueueTimer
DeleteTimerQueueTimer
CreateTimerQueue
RtlUnwindEx
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread

user32

IsWindowVisible
GetDC
GetWindowRect
EnumDisplaySettingsW
EnumDisplayDevicesW
GetMonitorInfoW
EnumDisplayMonitors
CharUpperW
GetProcessWindowStation
MessageBoxW
GetWindowThreadProcessId
GetWindowTextW
GetClassNameW
IsWindow
FindWindowExW
wsprintfW
wsprintfA
GetCursorPos
ReleaseDC
IsIconic
GetDesktopWindow
DrawIconEx
GetSystemMetrics
GetUserObjectInformationW
LoadCursorW
OpenInputDesktop
SetThreadDesktop
EnumWindows
CloseDesktop
GetForegroundWindow
GetThreadDesktop

advapi32

RegCreateKeyExW
RegQueryValueExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
DuplicateTokenEx
RegOpenKeyExA
RegCloseKey
RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
EqualSid
ConvertSidToStringSidA
SetFileSecurityW
SetSecurityDescriptorDacl
GetTokenInformation
LookupAccountNameW
RegQueryValueExW
LookupAccountSidW
ConvertSidToStringSidW
CreateProcessAsUserW
FreeSid
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
OpenProcessToken
ImpersonateLoggedOnUser
RevertToSelf
AdjustTokenPrivileges
LookupPrivilegeValueW
GetUserNameW
DeregisterEventSource
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
RegSetValueExW

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHGetFolderPathW
SHCreateDirectoryExA

shlwapi

StrCmpIW
SHSetValueA
StrToIntExA
PathAddBackslashW
PathIsDirectoryW
StrStrIA
PathFileExistsA
wnsprintfA
PathFindFileNameW
StrStrIW
PathFileExistsW
wnsprintfW
SHSetValueW
SHDeleteValueW
PathAppendW
PathIsNetworkPathW
PathFindExtensionW
wvnsprintfW
wvnsprintfA
PathFindFileNameA

sfc

SfcIsFileProtected

userenv

DestroyEnvironmentBlock
CreateEnvironmentBlock

netapi32

Netbios

ws2_32

htons
sendto
getaddrinfo
listen
htonl
accept
select
__WSAFDIsSet
WSACleanup
getsockopt
setsockopt
gethostbyname
getsockname
getpeername
ntohs
gethostname
inet_ntoa
ioctlsocket
getnameinfo
shutdown
freeaddrinfo
recv
WSAWaitForMultipleEvents
connect
socket
inet_addr
WSASetLastError
WSACreateEvent
WSACloseEvent
closesocket
WSAIoctl
bind
WSAResetEvent
send
WSAEnumNetworkEvents
recvfrom
WSAEventSelect
WSAGetLastError
WSAStartup

iphlpapi

GetAdaptersAddresses

crypt32

CryptMsgClose
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertGetNameStringW

wldap32

ord41
ord301
ord147
ord133
ord79
ord142
ord117
ord208
ord216
ord14
ord167
ord127
ord27
ord26
ord46
ord219
ord145

wtsapi32

WTSQueryUserToken

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW

wintrust

CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext
CryptCATAdminEnumCatalogFromHash
WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle

gdi32

DeleteDC
GetDIBits
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
GetDeviceCaps
CreateDCW
DeleteObject
GetObjectW

ole32

CoCreateGuid
CoInitialize
CoUninitialize
CoSetProxyBlanket
CoCreateInstance

oleaut32

SysAllocString
SysFreeString

gdiplus

GdipCloneImage
GdipAlloc
GdipDisposeImage
GdipGetImageEncoders
GdipFree
GdipSaveImageToFile
GdipCreateBitmapFromFile
GdipGetImageEncodersSize

Exports

Exports

BurnFileTraceHandler
CleanExpiredTriggerCaptureRecords
DebugXHandler
IMMonitorPolicyHandlerEx
NFSProtocolFilterPolicyHandler
NetBIOSProtocolFilterPolicyHandler
OtherDesSupplierHandler
SoftWareComplianceHandler
SoftwareInstallCtrlHandler
TelnetProtocolFilterPolicyHandler
TimingDeleteFileHandler
TriggeredScreenCapturePolicyHandlerEx
WindowsSecurityPassWDHandler

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 811KB - Virtual size: 811KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 76KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/WinDesPol.dll
.dll windows:5 windows x64 arch:x64

3321f43183cbc21a93e7609c377613af

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5e:d2:04:b6:2e:26:03:68:1e:58:57:21:52:34:e1:33:d8:b4:96:3f:b2:a0:96:6f:90:0e:ed:b9:8e:b6:15:66
Signer

Actual PE Digest

5e:d2:04:b6:2e:26:03:68:1e:58:57:21:52:34:e1:33:d8:b4:96:3f:b2:a0:96:6f:90:0e:ed:b9:8e:b6:15:66

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\x64\WinDesPol.pdb

Imports

kernel32

DisableThreadLibraryCalls
Sleep
QueueUserWorkItem
SleepEx
GetWindowsDirectoryW
QueueUserAPC
WaitForSingleObjectEx
TerminateThread
CreateEventW
OpenProcess
OpenEventW
WaitForSingleObject
RtlUnwind
CloseHandle
InitializeCriticalSection
LeaveCriticalSection
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
EnterCriticalSection
DeleteCriticalSection
DecodePointer
RaiseException
MoveFileExW
CreateDirectoryW
SetStdHandle
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLastError
InitializeCriticalSectionAndSpinCount
FormatMessageW
WideCharToMultiByte
SetLastError
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
EncodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetModuleFileNameA
GetFileSizeEx
WriteFile
OutputDebugStringA
CreateFileA
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
SetFilePointerEx
ReadFile
GetLogicalDrives
FindFirstFileW
HeapFree
FindNextFileW
lstrcpynW
DeviceIoControl
GetDriveTypeA
SetFilePointer
SetEndOfFile
GetTempPathW
FindClose
GetVolumeInformationA
LocalAlloc
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
GetModuleHandleA
SetFileAttributesW
GetFileAttributesExW
FileTimeToSystemTime
DeleteFileA
DeleteFileW
LoadLibraryW
HeapAlloc
LocalFree
GetProcessHeap
FreeLibrary
CreateFileMappingW
MapViewOfFile
LoadLibraryExW
lstrlenW
GetFileSize
OutputDebugStringW
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
CreateMutexW
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
LoadLibraryA
GetVersionExA
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
CreateThread
OpenFileMappingA
SystemTimeToTzSpecificLocalTime
WritePrivateProfileStringA
GetComputerNameW
CreateDirectoryA
GetPrivateProfileStringA
GetDriveTypeW
GetModuleFileNameW
OpenMutexW
OpenFileMappingW
ReleaseMutex
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
ExitThread
FreeLibraryAndExitThread
GetStdHandle
GetFileType
WriteConsoleW
SetConsoleCtrlHandler
GetACP
GetDateFormatW
GetTimeFormatW
GetCurrentDirectoryW

user32

GetProcessWindowStation
GetUserObjectInformationW
CharUpperW
MessageBoxW
wsprintfA

shlwapi

PathFileExistsW
SHSetValueW
StrToIntExA
wnsprintfA
PathFindFileNameA
PathFileExistsA
PathAppendW
wnsprintfW
PathFindFileNameW
PathMatchSpecW
SHSetValueA
wvnsprintfA
PathAppendA
SHDeleteValueA

ws2_32

__WSAFDIsSet
WSAGetLastError
setsockopt
htons
recv
shutdown
getnameinfo
ioctlsocket
send
WSAEnumNetworkEvents
WSAEventSelect
WSACloseEvent
gethostbyname
inet_ntoa
gethostname
bind
WSAIoctl
getpeername
getsockname
getsockopt
ntohs
WSAStartup
WSACleanup
WSACreateEvent
select
accept
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
connect
socket
inet_addr
WSASetLastError
closesocket

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

crypt32

CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CryptMsgClose
CertDuplicateCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CertOpenStore
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFreeCertificateContext

wintrust

CryptCATAdminReleaseCatalogContext
CryptCATAdminReleaseContext
CryptCATAdminAcquireContext
CryptCATCatalogInfoFromContext
WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash

netapi32

Netbios

rpcrt4

UuidFromStringA

iphlpapi

GetAdaptersAddresses

wldap32

ord27
ord41
ord208
ord216
ord14
ord46
ord219
ord145
ord117
ord26
ord127
ord167
ord142
ord79
ord133
ord147
ord301

advapi32

OpenProcessToken
RegSetValueExW
GetTokenInformation
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExW
RegOpenKeyExA
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCloseKey
RegQueryValueExA
RegCreateKeyExW

shell32

SHCreateDirectoryExA
SHCreateDirectoryExW
SHGetSpecialFolderPathW

Exports

Exports

DesPolGetKeyFromHeader
DesPolGetKeyNewFile
DesPolGetPolicyDirectoryListing
DesPolGetPolicyExistingFile
DesPolGetPolicyNewFile
InitDesPol

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 763KB - Virtual size: 762KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/WinDevMon.dll
.dll windows:5 windows x64 arch:x64

80303ee965764102b7a40db9f22284e0

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d4:11:74:72:ea:9e:15:47:2e:9f:5d:ef:1b:d9:b4:51:54:5a:e0:a5:08:87:78:a5:df:a3:74:f1:55:fe:8c:88
Signer

Actual PE Digest

d4:11:74:72:ea:9e:15:47:2e:9f:5d:ef:1b:d9:b4:51:54:5a:e0:a5:08:87:78:a5:df:a3:74:f1:55:fe:8c:88

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\Nsec\Release\Client\x64\WinDevMon.pdb

Imports

kernel32

HeapSize
SetStdHandle
GetConsoleCP
FlushFileBuffers
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
HeapReAlloc
GetConsoleMode
GetFileType
GetStdHandle
WriteConsoleW
DeleteCriticalSection
ResetEvent
WaitForSingleObjectEx
SetEvent
GetLastError
CreateEventW
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetACP
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
ExitProcess
InterlockedFlushSList
RaiseException
RtlPcToFileHeader
WideCharToMultiByte
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
LCMapStringW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleFileNameA
GetFileSizeEx
WriteFile
OutputDebugStringA
CreateFileA
GetSystemDirectoryA
CloseHandle
SetFileAttributesA
GetLocalTime
SetFilePointerEx
HeapFree
FindClose
CreateFileW
OpenProcess
HeapAlloc
LocalFree
GetProcessHeap
FreeLibrary
LoadLibraryExW
RtlUnwindEx

user32

wsprintfA
UnregisterDeviceNotification
RegisterDeviceNotificationW

setupapi

CM_Get_DevNode_Status
SetupDiOpenDeviceInfoA
SetupDiGetDeviceInstanceIdA
SetupDiDestroyDeviceInfoList
SetupDiCallClassInstaller
SetupDiCreateDeviceInfoList
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA
SetupDiGetClassDevsW
SetupDiSetClassInstallParamsW

shlwapi

wvnsprintfA
SHSetValueA
PathFindFileNameA
wnsprintfA

advapi32

GetTokenInformation
RegQueryValueExW
RegCloseKey
OpenProcessToken
RegOpenKeyExW
ConvertSidToStringSidW

shell32

SHCreateDirectoryExA

Exports

Exports

GetNxWinDevObject
NotifyNxWinDevMon
StartNxWinDevMon
StopNxWinDevMon

Sections

.text
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/WinDteCore64.dll
.dll windows:5 windows x64 arch:x64

96ac06e6931b7042cb9f2f661ef9367f

Code Sign

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

19/02/2021, 00:00

Not After

25/04/2023, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

32:1e:ae:85:2e:b1:38:59:ba:3f:1e:b7:6a:eb:20:8f:b0:c4:2f:58:3a:39:d3:13:e2:67:a4:e6:11:21:3c:08
Signer

Actual PE Digest

32:1e:ae:85:2e:b1:38:59:ba:3f:1e:b7:6a:eb:20:8f:b0:c4:2f:58:3a:39:d3:13:e2:67:a4:e6:11:21:3c:08

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Bin-Build\Client\x64\WinDteCore64.pdb

Imports

kernel32

FindFirstFileExW
FindNextFileW
FindClose
DuplicateHandle
LockFile
UnlockFileEx
LockFileEx
MapViewOfFile
MoveFileWithProgressW
MoveFileW
DeleteFileW
GetFileAttributesW
SetFileAttributesW
ReadFile
CreateFileW
OutputDebugStringW
ReadFileEx
ReadFileScatter
ReplaceFileW
WriteFileEx
WriteFileGather
GetTempPathW
ResetEvent
GetFileInformationByHandle
OpenFileMappingW
CopyFileExW
CopyFileW
TlsFree
TlsGetValue
TlsAlloc
TlsSetValue
DeleteCriticalSection
FindFirstFileW
LeaveCriticalSection
EnterCriticalSection
DisableThreadLibraryCalls
GetModuleFileNameW
GetCompressedFileSizeW
SetEndOfFile
GetTickCount
GetCurrentProcessId
MoveFileExW
SetFilePointerEx
SetEvent
CreateFileA
GetFileAttributesExW
ReleaseMutex
CreateMutexW
GetFileSizeEx
LoadLibraryExW
FreeLibrary
GetModuleHandleW
GetProcAddress
MapViewOfFileEx
CreateFileMappingW
GetFileSize
UnmapViewOfFile
SetFilePointer
WriteFile
VirtualQuery
SetThreadContext
FlushInstructionCache
GetThreadContext
GetCurrentThread
SuspendThread
InitializeCriticalSection
GetShortPathNameW
GetCurrentThreadId
VirtualAlloc
GetCurrentProcess
VirtualFree
VirtualProtect
GetExitCodeProcess
VirtualQueryEx
IsWow64Process
CreateProcessW
ReadProcessMemory
ExitProcess
VirtualAllocEx
VirtualProtectEx
GetTimeZoneInformation
GetCurrentDirectoryW
SetStdHandle
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetStringTypeW
ReadConsoleW
GetConsoleMode
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetACP
WriteConsoleW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
InterlockedFlushSList
RtlUnwindEx
RaiseException
EncodePointer
RtlPcToFileHeader
OpenFileMappingA
SystemTimeToTzSpecificLocalTime
SetFileTime
FlushFileBuffers
GetSystemTime
SystemTimeToFileTime
CreateFileMappingA
UnlockFile
HeapDestroy
HeapCompact
GetSystemInfo
HeapReAlloc
GetVersionExA
WaitForSingleObjectEx
FlushViewOfFile
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
HeapSize
HeapValidate
GetFullPathNameA
GetDiskFreeSpaceW
CloseHandle
GetLastError
OpenProcess
ResumeThread
WaitForSingleObject
GetEnvironmentVariableW
TerminateProcess
SetLastError
WriteProcessMemory
GetFullPathNameW
HeapCreate
TryEnterCriticalSection
AreFileApisANSI
GetSystemDirectoryA
OutputDebugStringA
DecodePointer
lstrlenW
WideCharToMultiByte
MultiByteToWideChar
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
HeapFree
HeapAlloc
SetFileAttributesA
GetProcessHeap
Sleep
GetDriveTypeW
GetModuleFileNameA
GetLocalTime
LocalFree
OpenMutexW
DeleteFileA
FormatMessageA
VerSetConditionMask
SleepEx
VerifyVersionInfoA
WaitForMultipleObjects
GetFileType
GetStdHandle
PeekNamedPipe
LoadLibraryA
QueryDosDeviceW
lstrcpynW
GetVersionExW
CreateEventW
FileTimeToSystemTime
LoadLibraryW

user32

GetMessageW
DispatchMessageA
CallNextHookEx
IsWindow
UnhookWindowsHookEx
DefWindowProcA
CreateWindowExA
TranslateMessage
LoadIconW
LoadCursorW
PostQuitMessage
RegisterClassExA
UpdateWindow
SetWindowsHookExW
CharUpperW
wsprintfA

gdi32

GetStockObject

advapi32

RegSetValueExW
RegOpenKeyExW
CryptAcquireContextA
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptDestroyKey
CryptImportKey
CryptEncrypt
GetTokenInformation
RegQueryValueExW
ConvertSidToStringSidW
OpenProcessToken
RegSetValueExA
RegCloseKey
RegCreateKeyExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCreateKeyExA

shell32

SHCreateDirectoryExA
SHGetSpecialFolderPathW

ole32

CoCreateInstance
OleCreateFromFile
OleCreateLinkEx
OleCreateLink
OleCreateLinkToFileEx
OleCreateLinkToFile
StgOpenStorageEx
StgOpenStorage
OleCreateFromFileEx

shlwapi

StrToIntExA
PathFindFileNameA
wvnsprintfA
SHDeleteValueA
PathAppendW
SHSetValueA
PathAddBackslashW
StrCmpNIW
PathMatchSpecW
PathFindFileNameW
wnsprintfW
wnsprintfA
wvnsprintfW
PathAppendA

ws2_32

__WSAFDIsSet
select
WSASetLastError
recv
send
sendto
recvfrom
htons
freeaddrinfo
ioctlsocket
listen
accept
gethostname
WSAStartup
WSACleanup
bind
getaddrinfo
WSAIoctl
socket
setsockopt
ntohs
closesocket
connect
getpeername
getsockname
getsockopt
WSAGetLastError

wldap32

ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord60
ord211
ord46
ord143

sfc

SfcIsFileProtected

rpcrt4

UuidFromStringA

Exports

Exports

DetourFinishHelperProcess
InstallHook
UninstallHook

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 364KB - Virtual size: 363KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 65KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.detourc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.shared
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/WinFsCore.dll
.dll windows:6 windows x64 arch:x64

8528bb6da553c44473ae6063061647ef

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3d:61:45:6d:b3:0d:29:1f:48:76:8a:5e:77:e9:52:bc:15:79:ef:81:d4:e1:87:5a:91:8a:30:7e:7a:4a:dc:e3
Signer

Actual PE Digest

3d:61:45:6d:b3:0d:29:1f:48:76:8a:5e:77:e9:52:bc:15:79:ef:81:d4:e1:87:5a:91:8a:30:7e:7a:4a:dc:e3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\UM_FESF\x64\Release\WinFsCore.pdb

Imports

mpr

WNetGetUniversalNameW

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlUnwindEx
RtlPcToFileHeader
NtCreateFile
NtQueryInformationFile
NtQueryEaFile
NtSetEaFile
RtlNtStatusToDosError

kernel32

WriteFile
DeviceIoControl
CreateFileW
GetConsoleCP
GetEnvironmentVariableW
GetCurrentProcessId
ReadFile
SetLastError
DeleteFileW
SetFilePointerEx
LocalFree
ReplaceFileW
GetVolumePathNamesForVolumeNameW
MoveFileW
GetCommandLineW
CloseHandle
GetCurrentThread
GetLastError
GetCurrentProcess
GetConsoleMode
SetStdHandle
GetFileSizeEx
HeapSize
WriteConsoleW
SetFileInformationByHandle
TerminateProcess
GetConsoleOutputCP
FlushFileBuffers
GetProcessHeap
FreeEnvironmentStringsW
MultiByteToWideChar
FormatMessageA
GetCPInfoExW
InitOnceComplete
InitOnceBeginInitialize
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCommandLineA
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW

advapi32

SetNamedSecurityInfoW
GetNamedSecurityInfoW
RegGetValueW
CopySid
ConvertStringSidToSidW
IsValidSid
GetLengthSid
LookupPrivilegeValueW
AdjustTokenPrivileges
PrivilegeCheck
OpenProcessToken
OpenThreadToken

Exports

Exports

??0FEU2Exception@@QEAA@KJ@Z
?FesfUtil2FixFileTag@@YAXV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?FesfUtil2GetBuildStamp@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?FesfUtil2GetExecutablePathForThreadId@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@I@Z
?FesfUtil2GetFileSize@@YA_KV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?FesfUtil2GetFullyQualifiedPath@@YA?AU?$pair@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@_N@std@@U_GUID@@V?$basic_string_view@_WU?$char_traits@_W@std@@@2@@Z
?FesfUtil2GetSidForThreadId@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@I@Z
?FesfUtil2GetUniversalFilePath@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@V?$basic_string_view@_WU?$char_traits@_W@std@@@2@@Z
?FesfUtil2GetVersion@@YA?AU?$pair@II@std@@XZ
?FesfUtil2IsFileFesfEncrypted@@YA_NV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?FesfUtil2IsThreadIdInSid@@YA_NIV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?FesfUtil2PurgePolicyCache@@YAXI@Z
?FesfUtil2PurgePolicyCache@@YAXV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?FesfUtil2ReadHeaderExclusive@@YA?AUFESF_UTIL2_SOLUTION_HEADER@@V?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?FesfUtil2ReadHeaderUnsafe@@YA?AUFESF_UTIL2_SOLUTION_HEADER@@V?$basic_string_view@_WU?$char_traits@_W@std@@@std@@@Z
?FesfUtil2UpdateHeaderExclusive@@YAXV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@AEBUFESF_UTIL2_SOLUTION_HEADER@@@Z
?FesfUtil2UpdateHeaderExclusiveWithExtension@@YAXV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@AEBUFESF_UTIL2_SOLUTION_HEADER@@AEBV12@@Z
?FesfUtil2UpdateHeaderUnsafe@@YAXV?$basic_string_view@_WU?$char_traits@_W@std@@@std@@AEBUFESF_UTIL2_SOLUTION_HEADER@@@Z
?GetMessageString@FEU2Exception@@QEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?IsNativeError@FEU2Exception@@QEBA_NXZ
?NtStatus@FEU2Exception@@QEBAKXZ
?ThrowFromNtError@FEU2Exception@@SAXJ@Z
?ThrowFromWin32Error@FEU2Exception@@SAXK@Z
?Win32Error@FEU2Exception@@QEBAKXZ
?what@FEU2Exception@@UEBAPEBDXZ
FesfUtil2FixFileTag_C
FesfUtil2GetExecutablePathForThreadId_C
FesfUtil2GetFileSize_C
FesfUtil2GetFullyQualifiedPath_C
FesfUtil2GetSidForThreadId_C
FesfUtil2GetUniversalFilePath_C
FesfUtil2GetVersion_C
FesfUtil2IsFileFesfEncrypted_C
FesfUtil2IsThreadIdInSid_C
FesfUtil2PurgePolicyCacheForFile_C
FesfUtil2PurgePolicyCacheForThreadId_C
FesfUtil2ReadHeaderExclusive_C
FesfUtil2ReadHeaderUnsafe_C
FesfUtil2UpdateHeaderExclusiveWithExtension_C
FesfUtil2UpdateHeaderExclusive_C
FesfUtil2UpdateHeaderUnsafe_C

Sections

.text
Size: 276KB - Virtual size: 276KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/WinMrkx64.dll
.dll windows:5 windows x64 arch:x64

2a31c7c8d76bdd6f9767432ddd9a1297

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

98:cb:4b:80:87:70:f1:f7:87:49:ff:aa:c8:ed:b4:45:db:ab:bd:c8:dd:51:ae:11:2a:bf:f5:33:47:d0:08:95
Signer

Actual PE Digest

98:cb:4b:80:87:70:f1:f7:87:49:ff:aa:c8:ed:b4:45:db:ab:bd:c8:dd:51:ae:11:2a:bf:f5:33:47:d0:08:95

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\x64\WinMrkx64.pdb

Imports

kernel32

GetCurrentProcessId
GetComputerNameW
CreateFileA
GetFileAttributesExA
ReadFile
Sleep
LoadLibraryExW
FreeLibrary
GetModuleHandleW
DisableThreadLibraryCalls
CreateFileMappingW
GetFileSize
UnmapViewOfFile
SetFilePointer
WriteFile
VirtualQuery
SetThreadContext
GetProcAddress
FlushInstructionCache
GetThreadContext
GetCurrentThread
RtlUnwind
GetCurrentThreadId
VirtualAlloc
GetCurrentProcess
VirtualFree
VirtualProtect
VirtualQueryEx
DecodePointer
SystemTimeToTzSpecificLocalTime
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
ReadConsoleA
SetConsoleMode
ExitProcess
VirtualProtectEx
CloseHandle
GetLastError
OpenProcess
ResumeThread
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
CompareFileTime
SleepEx
MoveFileExW
SetStdHandle
GetTimeZoneInformation
SuspendThread
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
WaitForSingleObject
GetEnvironmentVariableA
GetEnvironmentVariableW
TerminateProcess
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
GetStringTypeW
ReadConsoleW
GetConsoleMode
GetACP
FreeLibraryAndExitThread
ExitThread
CreateThread
WriteConsoleW
SetLastError
GetModuleHandleExW
GetFileType
GetStdHandle
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
InterlockedFlushSList
RaiseException
RtlPcToFileHeader
RtlUnwindEx
TerminateThread
SetFilePointerEx
GetSystemDirectoryA
GetFileSizeEx
FileTimeToSystemTime
CreateEventW
GetModuleHandleA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
GetLocalTime
GetTickCount
GetLogicalDrives
HeapFree
GetDriveTypeA
GetVolumeInformationA
HeapAlloc
SetFileAttributesA
GetProcessHeap
GetPrivateProfileStringA
SetFileAttributesW
GetDriveTypeW
CreateMutexW
LocalFree
GetModuleFileNameW
GetModuleFileNameA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
MapViewOfFile
DeleteFileA
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateFileW
GetFileAttributesW
GetVersionExW
HeapValidate
HeapSize
MultiByteToWideChar
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
DeleteCriticalSection
SystemTimeToFileTime
WideCharToMultiByte
GetSystemTime
FormatMessageA
FlushFileBuffers
FindFirstFileW
FindNextFileW
DeviceIoControl
FindClose
GetCurrentDirectoryW

user32

GetMessageW
CallNextHookEx
DefWindowProcW
GetDC
UnhookWindowsHookEx
SetWindowsHookExW
IsWindowVisible
SetWindowPos
SendMessageW
UnregisterClassW
RegisterClassExW
ShowWindow
DispatchMessageW
CreateWindowExA
GetDesktopWindow
TranslateMessage
LoadIconW
LoadCursorW
GetClassNameW
UpdateLayeredWindow
PostQuitMessage
GetClassInfoExW
ReleaseDC
EnableWindow
GetWindowThreadProcessId
CreateDialogParamW
GetWindowRect
GetParent
GetAncestor
IsWindow
CreateWindowExW
GetProcessWindowStation
MessageBoxW
BeginPaint
GetUserObjectInformationW
GetWindowLongW
SetWindowLongPtrW
GetWindowLongPtrW
RegisterClassW
wsprintfA
EndPaint
SetLayeredWindowAttributes
UpdateWindow
SetWindowLongW

gdi32

CreateDIBSection
SelectObject
CreateSolidBrush
GdiFlush
CreateFontW
GetStockObject
GetTextMetricsW
DeleteDC
DeleteObject
GetObjectA
CreatePen
SetBkMode
Ellipse
CreateCompatibleDC

advapi32

RegQueryValueExA
ConvertSidToStringSidA
RegOpenKeyExW
RegCloseKey
GetTokenInformation
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExA
OpenProcessToken
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
GetUserNameW

shlwapi

wvnsprintfA
PathAppendW
PathFileExistsW
SHSetValueA
PathFileExistsA
wnsprintfW
StrStrIW
wnsprintfA
PathFindFileNameA

gdiplus

GdipCreatePen1
GdipDeletePen
GdipTranslateWorldTransform
GdipDeleteFont
GdipDeleteStringFormat
GdipSetStringFormatAlign
GdipGetPenFillType
GdipCloneBrush
GdipRotateWorldTransform
GdipSetTextRenderingHint
GdipCreateFromHDC
GdipResetWorldTransform
GdipDrawString
GdipFree
GdipCreateFontFromDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipAlloc
GdipDeleteBrush
GdipCreateFontFromLogfontA
GdipSetCompositingQuality
GdipCreateStringFormat
GdiplusShutdown
GdiplusStartup
GdipCreateSolidFill
GdipFillEllipseI
GdipGetPenBrushFill

netapi32

NetUserGetInfo
NetApiBufferFree
Netbios

iphlpapi

GetAdaptersAddresses

ws2_32

htonl
listen
setsockopt
freeaddrinfo
recvfrom
sendto
__WSAFDIsSet
WSACleanup
WSAStartup
ntohs
getsockopt
getsockname
getpeername
accept
gethostname
WSAEventSelect
WSAEnumNetworkEvents
send
bind
WSAGetLastError
gethostbyname
inet_ntoa
ioctlsocket
getnameinfo
shutdown
htons
recv
connect
socket
WSAIoctl
closesocket
WSACloseEvent
select
WSACreateEvent
WSASetLastError
getaddrinfo

crypt32

CertFreeCertificateContext
CertCloseStore
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFindCertificateInStore
CertDuplicateCertificateContext

wldap32

ord301
ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord41
ord208
ord216
ord14
ord46
ord219
ord145
ord117

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHCreateDirectoryExA

ole32

CoCreateGuid

Exports

Exports

StartWindowWatermark
StopWindowWatermark

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 673KB - Virtual size: 673KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 70KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/WinNetGuard64.dll
.dll windows:5 windows x64 arch:x64

f6fe1f8ba7506ebe95524c7e0b660c34

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

15:b7:b2:2c:53:d4:05:e9:d3:e9:56:b9:b6:30:fa:49:b8:bf:f0:bd:a5:5e:b1:9e:e3:51:06:4d:53:7c:2c:e7
Signer

Actual PE Digest

15:b7:b2:2c:53:d4:05:e9:d3:e9:56:b9:b6:30:fa:49:b8:bf:f0:bd:a5:5e:b1:9e:e3:51:06:4d:53:7c:2c:e7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\x64\WinNetGuard64.pdb

Imports

kernel32

ResetEvent
RtlUnwind
SystemTimeToTzSpecificLocalTime
DisableThreadLibraryCalls
SleepEx
FreeLibrary
GetCurrentProcessId
DeleteCriticalSection
LocalFree
GetProcAddress
QueueUserAPC
LoadLibraryW
TerminateThread
GetLastError
CreateEventW
InitializeCriticalSection
WaitForMultipleObjects
SetLastError
CreateProcessW
GlobalMemoryStatus
CloseHandle
WaitForSingleObject
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
GetEnvironmentVariableA
CompareFileTime
QueryPerformanceFrequency
MoveFileExW
CreateDirectoryW
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
CreateProcessA
GetConsoleCP
ReadConsoleW
GetConsoleMode
FormatMessageW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
ReadFile
CreatePipe
CreateMutexW
GetSystemDirectoryW
GetExitCodeProcess
GetLogicalDrives
SetFileAttributesW
Sleep
GetDriveTypeW
HeapFree
GetDriveTypeA
GetVolumeInformationA
CreateFileA
HeapAlloc
SetFileAttributesA
GetComputerNameW
GetProcessHeap
GetPrivateProfileStringA
WriteFile
SetEvent
DeleteFileA
OpenFileMappingW
GetLocalTime
CreateFileMappingW
MapViewOfFile
GetModuleFileNameA
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateFileW
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
DeleteFileW
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetFileSize
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
FindFirstFileW
FindNextFileW
DeviceIoControl
FindClose
GetModuleHandleA
OpenProcess
FileTimeToSystemTime
LoadLibraryExW
GetFileSizeEx
GetSystemDirectoryA
SetFilePointerEx
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedPushEntrySList
InterlockedFlushSList
ExitProcess
GetModuleHandleExW
GetStdHandle
GetFileType
WriteConsoleW
CreateThread
ExitThread
FreeLibraryAndExitThread
SetConsoleCtrlHandler
GetACP
GetDateFormatW
GetTimeFormatW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetCurrentDirectoryW

advapi32

RegQueryValueExA
RegOpenKeyExA
RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
RegCloseKey
SetSecurityDescriptorDacl
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegQueryValueExW
CryptGenRandom
CryptDecrypt
OpenProcessToken
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
SetFileSecurityW
ConvertSidToStringSidW

ole32

CoCreateGuid

shlwapi

PathFileExistsA
PathAppendW
StrStrIA
wnsprintfA
SHSetValueA
PathFindFileNameA
wvnsprintfA
wnsprintfW
PathFileExistsW

iphlpapi

GetIpInterfaceEntry
GetAdaptersAddresses
CreateUnicastIpAddressEntry
InitializeIpForwardEntry
InitializeIpInterfaceEntry
InitializeUnicastIpAddressEntry
CreateIpForwardEntry2
SetIpInterfaceEntry

netapi32

Netbios

ws2_32

inet_addr
socket
connect
WSAWaitForMultipleEvents
recv
setsockopt
WSAGetLastError
gethostbyname
WSASetLastError
gethostname
inet_pton
htons
WSACleanup
__WSAFDIsSet
select
accept
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
WSACreateEvent
WSACloseEvent
WSAStartup
closesocket
WSAIoctl
bind
ntohs
send
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
getpeername
getsockname
inet_ntoa
getsockopt
ioctlsocket
getnameinfo
shutdown
htonl

crypt32

CertOpenStore
CertCloseStore
CertFreeCertificateContext
CertFindCertificateInStore
CryptStringToBinaryA
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty

wldap32

ord301
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145
ord147

user32

GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW
wsprintfA

shell32

SHCreateDirectoryExA
SHGetSpecialFolderPathW
SHCreateDirectoryExW

Exports

Exports

ConnectToVPNServer
DisConnectToVPNServer
InitializeVPNService
VPNPolicyHandlerEx

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 738KB - Virtual size: 737KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 72KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/WinNtDes.dll
.dll windows:5 windows x64 arch:x64

953321fda57ba2548c11bf0193caf664

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3c:d5:57:b6:36:fb:58:00:13:73:d6:66:43:35:96:f8:41:b5:71:0f:95:85:d0:52:ce:e0:a7:50:93:a7:5a:e5
Signer

Actual PE Digest

3c:d5:57:b6:36:fb:58:00:13:73:d6:66:43:35:96:f8:41:b5:71:0f:95:85:d0:52:ce:e0:a7:50:93:a7:5a:e5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\x64\WinNtDes.pdb

Imports

kernel32

GetSystemDirectoryW
SleepEx
GetWindowsDirectoryW
QueueUserAPC
WaitForSingleObjectEx
TerminateThread
CreateEventW
OpenEventW
WaitForSingleObject
GetModuleFileNameW
GetTickCount
DisableThreadLibraryCalls
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
MapViewOfFile
CreateFileMappingW
OpenProcess
UnmapViewOfFile
CreateFileW
GlobalMemoryStatus
ConvertThreadToFiber
Sleep
QueueUserWorkItem
OpenThread
GetProcessIdOfThread
GetProcessHeap
DeleteCriticalSection
HeapDestroy
DecodePointer
HeapAlloc
SystemTimeToTzSpecificLocalTime
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
MoveFileExW
CreateDirectoryW
SetStdHandle
GetConsoleCP
CloseHandle
RtlUnwind
ReadConsoleW
GetConsoleMode
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
RaiseException
HeapReAlloc
GetLastError
HeapSize
GetDateFormatW
GetACP
SetConsoleCtrlHandler
WriteConsoleW
GetFileType
GetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
ExitProcess
InterlockedFlushSList
RtlPcToFileHeader
RtlUnwindEx
ReleaseMutex
OpenMutexW
OpenFileMappingW
InitializeCriticalSectionAndSpinCount
HeapFree
FormatMessageW
WideCharToMultiByte
SetLastError
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
EncodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
OutputDebugStringW
GetModuleFileNameA
GetFileSizeEx
WriteFile
OutputDebugStringA
CreateFileA
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
SetFilePointerEx
ReadFile
QueryDosDeviceW
GetLogicalDrives
FindFirstFileW
FindNextFileW
lstrcpynW
DeviceIoControl
GetDriveTypeA
SetFilePointer
SetEndOfFile
GetTempPathW
FindClose
GetVolumeInformationA
LocalAlloc
GetFileAttributesW
GetVersionExW
GetModuleHandleA
SetFileAttributesW
GetFileAttributesExW
FileTimeToSystemTime
DeleteFileA
DeleteFileW
LoadLibraryW
LocalFree
FreeLibrary
LoadLibraryExW
lstrlenW
GetFileSize
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
CreateMutexW
HeapValidate
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
FlushViewOfFile
LoadLibraryA
GetVersionExA
GetSystemInfo
HeapCompact
UnlockFile
CreateFileMappingA
LockFileEx
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
WritePrivateProfileStringA
GetComputerNameW
CreateDirectoryA
GetPrivateProfileStringA
GetDriveTypeW
GetCurrentDirectoryW

user32

GetUserObjectInformationW
MessageBoxW
wsprintfA
CharUpperW
GetProcessWindowStation

advapi32

InitializeSecurityDescriptor
RegCreateKeyExW
SetEntriesInAclW
AllocateAndInitializeSid
RegQueryValueExA
SetFileSecurityW
RegCloseKey
GetTokenInformation
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExW
RegOpenKeyExA
AdjustTokenPrivileges
RegSetValueExW
OpenProcessToken
SetSecurityDescriptorDacl
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ConvertStringSecurityDescriptorToSecurityDescriptorW
LookupPrivilegeValueW

ole32

CoInitializeEx

oleaut32

VariantClear
SysAllocStringLen
SysStringLen
SysAllocString
SysFreeString

shlwapi

SHSetValueW
SHSetValueA
StrToIntExA
PathAppendA
PathFileExistsA
PathFindFileNameA
SHDeleteValueA
wvnsprintfA
PathAppendW
PathFindFileNameW
wnsprintfW
PathMatchSpecW
wnsprintfA
PathFileExistsW

winntdes.exe

FePolSetConfiguration

winfscore

FesfUtil2GetSidForThreadId_C
FesfUtil2ReadHeaderExclusive_C
FesfUtil2PurgePolicyCacheForThreadId_C
FesfUtil2ReadHeaderUnsafe_C
FesfUtil2GetFullyQualifiedPath_C
FesfUtil2GetExecutablePathForThreadId_C
FesfUtil2PurgePolicyCacheForFile_C

ws2_32

closesocket
shutdown
getnameinfo
ioctlsocket
sendto
recvfrom
freeaddrinfo
getaddrinfo
listen
htonl
WSAGetLastError
accept
select
setsockopt
htons
recv
connect
socket
inet_addr
WSASetLastError
__WSAFDIsSet
WSACleanup
WSACreateEvent
WSACloseEvent
WSAIoctl
bind
gethostname
send
WSAStartup
ntohs
getsockopt
getsockname
inet_ntoa
gethostbyname
WSAEventSelect
getpeername
WSAEnumNetworkEvents

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

psapi

GetModuleFileNameExW

crypt32

CryptMsgClose
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertDuplicateCertificateContext
CertGetNameStringW
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFindCertificateInStore

wintrust

CryptCATAdminReleaseContext
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext
CryptCATAdminEnumCatalogFromHash
WinVerifyTrust
CryptCATAdminCalcHashFromFileHandle

netapi32

Netbios

rpcrt4

UuidFromStringA

iphlpapi

GetAdaptersAddresses

wldap32

ord117
ord145
ord219
ord46
ord14
ord216
ord208
ord41
ord301
ord26
ord27
ord127
ord167
ord142
ord79
ord133
ord147

shell32

SHCreateDirectoryExW
SHCreateDirectoryExA
SHGetSpecialFolderPathW

Exports

Exports

PolicyDllInit
PurgePolicyCacheFile

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 800KB - Virtual size: 799KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 73KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 136KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/WinNtDes.exe
.exe windows:6 windows x64 arch:x64

dc55a1b5a7205f483d7c48a96d6d7355

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6b:18:98:1f:1c:7e:71:c9:26:db:ac:8a:25:5c:93:fa:88:a2:79:e0:91:1c:14:4f:3a:47:7a:9f:a5:52:f4:d6
Signer

Actual PE Digest

6b:18:98:1f:1c:7e:71:c9:26:db:ac:8a:25:5c:93:fa:88:a2:79:e0:91:1c:14:4f:3a:47:7a:9f:a5:52:f4:d6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\UM_FESF\x64\Release\WinNtDes.pdb

Imports

kernel32

LocalFree
FreeLibrary
SetConsoleCtrlHandler
DebugBreak
FlushFileBuffers
GetProcAddress
GetModuleFileNameW
FormatMessageW
GetTimeFormatW
GetDateFormatW
WriteConsoleW
GetOverlappedResult
ResetEvent
CreateThread
LoadLibraryW
CloseHandle
SetEvent
GetLastError
CreateEventW
ReleaseMutex
CreateFileW
LocalAlloc
WaitForSingleObject
CreateMutexW
WaitForMultipleObjects
DeviceIoControl
SetLastError
lstrlenW
CancelIo
MultiByteToWideChar
GetStringTypeW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetFileType
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
GetFileSizeEx
SetFilePointerEx
GetConsoleOutputCP
GetConsoleMode
HeapSize
ReadFile
ReadConsoleW
SetEndOfFile

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegisterServiceCtrlHandlerExW
SetServiceStatus
StartServiceCtrlDispatcherW
RegSetValueExW
RegGetValueW
RegDeleteValueW
SetSecurityDescriptorDacl
RegCloseKey
AllocateAndInitializeSid
SetEntriesInAclW
RegCreateKeyExW
FreeSid
InitializeSecurityDescriptor
RegQueryValueExW

Exports

Exports

FePolSetConfiguration

Sections

.text
Size: 187KB - Virtual size: 186KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/WinNtDs.exe
.exe windows:6 windows x64 arch:x64

c955909685ae7875ba931a7d50cc2a09

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1a:e4:e1:f7:9c:62:21:ec:d3:fc:75:e1:46:7a:b4:75:ce:33:41:3e:6c:0d:23:6d:dc:03:b3:d2:34:5a:65:6f
Signer

Actual PE Digest

1a:e4:e1:f7:9c:62:21:ec:d3:fc:75:e1:46:7a:b4:75:ce:33:41:3e:6c:0d:23:6d:dc:03:b3:d2:34:5a:65:6f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\NSecsoft\NSec\NX-DES\Src\UM_FESF\x64\Release\WinNtDs.pdb

Imports

ntdll

NtSetEaFile
NtQueryEaFile
RtlNtStatusToDosError
NtQueryInformationFile
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlPcToFileHeader
RtlUnwindEx
RtlCaptureContext
NtCreateFile

kernel32

FlushFileBuffers
GetFileSizeEx
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
DeviceIoControl
LCMapStringW
GetFileType
GetStdHandle
GetModuleHandleExW
ExitProcess
CreateThread
Sleep
CreateEventW
WaitForSingleObject
SetEvent
DecodePointer
GetCommandLineW
MultiByteToWideChar
ReplaceFileW
lstrcmpiW
LocalFree
FindResourceW
SizeofResource
LockResource
LoadResource
LoadLibraryExW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
FreeLibrary
FindResourceExW
GetCurrentThread
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
SetLastError
GetLastError
RaiseException
CloseHandle
SetFileTime
SetFileAttributesW
GetFileTime
GetFileAttributesW
DeleteFileW
CreateFileW
WriteConsoleW
VirtualQuery
VirtualProtect
VirtualAlloc
GetSystemInfo
TlsFree
GetCurrentThreadId
GetConsoleMode
GetConsoleOutputCP
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
TlsSetValue
TlsGetValue
TlsAlloc
EncodePointer
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
WaitForSingleObjectEx
ResetEvent
InitializeCriticalSectionAndSpinCount
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringW
IsDebuggerPresent

user32

CharNextW
LoadStringW
GetMessageW
TranslateMessage
DispatchMessageW
PostThreadMessageW
CharUpperW
MessageBoxW

advapi32

OpenSCManagerW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
OpenServiceW
DeleteService
CreateServiceW
ControlService
CloseServiceHandle
RegQueryValueExW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
SetNamedSecurityInfoW
GetNamedSecurityInfoW
RegSetValueExW
RegQueryInfoKeyW
RegOpenKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegCloseKey
LookupPrivilegeValueW
RevertToSelf
MakeSelfRelativeSD
IsValidSid
InitializeSid
InitializeAcl
ImpersonateSelf
GetTokenInformation
GetSidSubAuthority
GetSidLengthRequired
GetSecurityDescriptorSacl
GetSecurityDescriptorOwner
GetSecurityDescriptorLength
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
GetLengthSid
GetAclInformation
GetAce
EqualSid
CopySid
AdjustTokenPrivileges
AddAce
OpenThreadToken
SetThreadToken

ole32

CoReleaseServerProcess
CoAddRefServerProcess
CoResumeClassObjects
CoRevokeClassObject
CoRegisterClassObject
CoInitializeEx
CoUninitialize
CoInitializeSecurity
CoTaskMemRealloc
CoTaskMemAlloc
CoCreateGuid
StringFromGUID2
CoCreateInstance
CoRevertToSelf
CoImpersonateClient
CoCreateFreeThreadedMarshaler
CoTaskMemFree

oleaut32

SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
SysStringByteLen
SysAllocStringByteLen
UnRegisterTypeLi
RegisterTypeLi
LoadTypeLi
VarBstrCat
VarUI4FromStr
VariantClear
SafeArrayGetVartype
SafeArrayCopy
SafeArrayUnlock
SafeArrayLock
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayDestroy
SafeArrayCreate

userenv

UnloadUserProfile

Sections

.text
Size: 150KB - Virtual size: 150KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/WinSoMgrEx64.dll
.dll windows:5 windows x64 arch:x64

f056ea81bb3e8cc0b48de60a5a31a942

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b8:bb:6f:1b:4c:de:93:72:59:d9:30:dc:8a:a0:b9:50:c3:16:06:77:0c:1d:fb:60:58:94:09:ab:c6:8a:e6:df
Signer

Actual PE Digest

b8:bb:6f:1b:4c:de:93:72:59:d9:30:dc:8a:a0:b9:50:c3:16:06:77:0c:1d:fb:60:58:94:09:ab:c6:8a:e6:df

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\Nsec\Release\Client\x64\WinSoMgrEx64.pdb

Imports

kernel32

FileTimeToLocalFileTime
CloseHandle
FileTimeToSystemTime
GetFileAttributesExW
GetLastError
QueueUserAPC
TerminateThread
OpenProcess
CreateFileW
WaitForSingleObject
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
ReadFile
DeleteCriticalSection
QueueUserWorkItem
SleepEx
FreeLibrary
GetProcAddress
GetLocalTime
LoadLibraryW
CreateDirectoryW
VerifyVersionInfoW
VerSetConditionMask
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
MoveFileExW
GetCurrentDirectoryW
GetConsoleCP
SetStdHandle
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
GetTimeZoneInformation
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetACP
FreeLibraryAndExitThread
ExitThread
CreateThread
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
SetConsoleCtrlHandler
WriteConsoleW
ExitProcess
InterlockedFlushSList
InterlockedPushEntrySList
RaiseException
RtlPcToFileHeader
RtlUnwindEx
lstrlenW
LoadLibraryExW
FormatMessageW
WideCharToMultiByte
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
WaitForSingleObjectEx
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetFileSize
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
QueryPerformanceFrequency
GetFileSizeEx
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
CreateFileA
ReleaseMutex
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
GetStdHandle
GetEnvironmentVariableW
GetFileType
WriteFile
GetModuleHandleExW
SwitchToFiber
DeleteFiber
CreateFiber
ConvertFiberToThread
ConvertThreadToFiber
LoadLibraryA
FindClose
FindFirstFileW
FindNextFileW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
GetLogicalDrives
SetFileAttributesW
Sleep
GetDriveTypeW
CreateMutexW
GetSystemDirectoryW
LocalFree
OpenMutexW
MoveFileExA
DeleteFileA
OpenFileMappingW
CreateFileMappingW
GetDriveTypeA
GetVolumeInformationA
SetFileAttributesA
GetComputerNameW
GetProcessHeap
GetPrivateProfileStringA
GetModuleFileNameW
GetModuleFileNameA
AreFileApisANSI
TryEnterCriticalSection
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
GetFileAttributesW
GetVersionExW
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
GetVersionExA
DeleteFileW
HeapCompact
UnlockFile
LockFileEx
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
GetSystemDirectoryA
SetFilePointerEx
QueryDosDeviceW
lstrcpynW
DeviceIoControl
LocalAlloc
GetModuleHandleA
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
RtlUnwind

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueA
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
InitializeSecurityDescriptor
RegDeleteKeyExW
RegOpenKeyExW
RegCloseKey
SetFileSecurityW
ConvertSidToStringSidA
RegQueryValueExA
RegCreateKeyExW
RegSetValueExW
SetEntriesInAclW
ConvertSidToStringSidW
OpenProcessToken
RegQueryValueExW
GetTokenInformation
RegOpenKeyExA
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
AllocateAndInitializeSid

shlwapi

PathAppendW
StrToInt64ExA
wvnsprintfA
SHSetValueA
wnsprintfA
wnsprintfW
PathFindFileNameW
StrStrIA
SHEnumKeyExW
SHGetValueW
PathFileExistsW
PathFindExtensionW
StrStrIW
PathFileExistsA
StrToIntExA
PathFindFileNameA

psapi

EnumProcessModulesEx
EnumProcesses
GetModuleFileNameExW

bcrypt

BCryptGenRandom

iphlpapi

GetAdaptersAddresses

ws2_32

WSAStartup
gethostbyname
ntohs
getsockopt
getsockname
ioctlsocket
getaddrinfo
freeaddrinfo
getnameinfo
htons
send
WSASetLastError
accept
bind
closesocket
connect
listen
setsockopt
shutdown
WSACleanup
WSAWaitForMultipleEvents
inet_addr
WSACreateEvent
WSACloseEvent
socket
inet_ntoa
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
getpeername
__WSAFDIsSet
select
htonl
recvfrom
sendto
gethostname
WSAGetLastError
recv
WSAIoctl

crypt32

CertFreeCertificateContext
CertGetCertificateContextProperty
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetIntendedKeyUsage
CertGetEnhancedKeyUsage
CertDuplicateCertificateContext
CertOpenSystemStoreW

wldap32

ord142
ord145
ord46
ord14
ord301
ord147
ord133
ord79
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord219

netapi32

Netbios

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

user32

GetUserObjectInformationW
MessageBoxW
wsprintfA
CharUpperW
GetProcessWindowStation

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExA
SHCreateDirectoryExW

Exports

Exports

StartPiracyCheckEngine
StopPiracyCheckEngine

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 968KB - Virtual size: 968KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 110KB - Virtual size: 134KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 149KB - Virtual size: 149KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/WinSpolEx64.dll
.dll windows:5 windows x64 arch:x64

c2221bdfd4f399f5a9a927593adacff9

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

90:cc:67:7d:5c:7b:5f:3f:df:2d:9b:ce:11:fd:7e:c8:42:7f:df:2b:d1:33:ea:bc:4d:ee:9b:ee:9f:ad:22:89
Signer

Actual PE Digest

90:cc:67:7d:5c:7b:5f:3f:df:2d:9b:ce:11:fd:7e:c8:42:7f:df:2b:d1:33:ea:bc:4d:ee:9b:ee:9f:ad:22:89

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\x64\WinSpolEx64.pdb

Imports

kernel32

TlsFree
SystemTimeToTzSpecificLocalTime
RtlUnwind
DeleteCriticalSection
TlsAlloc
DisableThreadLibraryCalls
InitializeCriticalSection
SleepEx
QueueUserAPC
TerminateThread
MulDiv
GetTickCount
TlsGetValue
SystemTimeToFileTime
GetCurrentProcessId
GetLocalTime
CreateFileA
GetComputerNameExW
LeaveCriticalSection
GetModuleFileNameW
EnterCriticalSection
TlsSetValue
GetFileAttributesExA
ReadFile
LoadLibraryExW
FreeLibrary
GetModuleHandleW
GetProcAddress
CreateFileMappingW
GetFileSize
UnmapViewOfFile
SetFilePointer
WriteFile
VirtualQuery
SetThreadContext
FlushInstructionCache
GetThreadContext
GetCurrentThread
SuspendThread
GetCurrentThreadId
VirtualAlloc
GetCurrentProcess
VirtualFree
VirtualProtect
VirtualQueryEx
ExitProcess
VirtualProtectEx
CloseHandle
GetLastError
OpenProcess
ResumeThread
WaitForSingleObject
GetEnvironmentVariableA
GetEnvironmentVariableW
TerminateProcess
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
CompareFileTime
QueryPerformanceFrequency
MoveFileExW
CreateDirectoryW
SetStdHandle
GetTimeZoneInformation
SetLastError
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetConsoleCP
SetConsoleCtrlHandler
ReadConsoleW
GetConsoleMode
GetACP
FreeLibraryAndExitThread
ExitThread
CreateThread
WriteConsoleW
GetModuleHandleExW
GetFileType
GetStdHandle
InterlockedFlushSList
InterlockedPushEntrySList
RaiseException
RtlPcToFileHeader
RtlUnwindEx
GetCurrentDirectoryW
SetFilePointerEx
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
MultiByteToWideChar
FormatMessageW
WideCharToMultiByte
GetStringTypeW
SwitchToThread
EncodePointer
DecodePointer
GetCPInfo
CompareStringW
LCMapStringW
GetLocaleInfoW
GetLogicalDrives
HeapFree
GetDriveTypeA
GetVolumeInformationA
HeapAlloc
SetFileAttributesA
GetComputerNameW
GetProcessHeap
GetPrivateProfileStringA
SetFileAttributesW
Sleep
GetDriveTypeW
GetModuleFileNameA
DeleteFileA
OpenFileMappingW
MapViewOfFile
CreateMutexW
GetSystemDirectoryW
LocalFree
OpenMutexW
ReleaseMutex
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateFileW
GetFileAttributesW
GetVersionExW
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
GetVersionExA
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetSystemTime
FormatMessageA
FlushFileBuffers
lstrlenW
lstrcpynW
QueryDosDeviceW
FindFirstFileW
FindNextFileW
DeviceIoControl
FindClose
GetModuleHandleA
FileTimeToSystemTime
GetFileSizeEx
GetSystemDirectoryA

user32

GetProcessWindowStation
GetDC
wsprintfW
GetDesktopWindow
MessageBoxW
GetUserObjectInformationW
wsprintfA
CharUpperW
IsWindow
EnableWindow
EndPaint
BeginPaint
UpdateWindow
PostQuitMessage
SetWindowLongW
LoadCursorW
LoadIconW
TranslateMessage
SetLayeredWindowAttributes
RegisterClassW
DispatchMessageW
ShowWindow
GetWindowLongPtrW
UnregisterClassW
SendMessageW
CreateWindowExW
SetWindowLongPtrW
SetWindowPos
DefWindowProcW
GetMessageW
GetWindowLongW

gdi32

Escape
GetCurrentObject
SetROP2
ExtSelectClipRgn
SetMapMode
CloseFigure
ArcTo
CreateDCA
InvertRgn
RestoreDC
SetStretchBltMode
Ellipse
SetBkColor
MoveToEx
ExcludeClipRect
SetDCBrushColor
GetTextColor
SetArcDirection
FlattenPath
GetViewportExtEx
SetColorAdjustment
SetTextJustification
SelectClipRgn
SetViewportOrgEx
Rectangle
ScaleViewportExtEx
OffsetWindowOrgEx
SelectPalette
LineTo
SetBkMode
AngleArc
TextOutA
EndPath
SetMapperFlags
PolyPolygon
ExtEscape
SetPixelV
GetTextAlign
PolyTextOutW
SetPolyFillMode
StrokeAndFillPath
StrokePath
SetViewportExtEx
DeleteEnhMetaFile
SetMiterLimit
GetWindowOrgEx
MaskBlt
Polyline
OffsetViewportOrgEx
ExtFloodFill
CreateEnhMetaFileW
SelectClipPath
SetWindowExtEx
PolyDraw
PolyBezier
PolyBezierTo
OffsetClipRgn
GetClipBox
SetWindowOrgEx
SetSystemPaletteUse
CopyEnhMetaFileW
UpdateColors
StretchDIBits
PlayEnhMetaFile
PaintRgn
Chord
CloseEnhMetaFile
PlgBlt
RealizePalette
EndDoc
BeginPath
SetMetaRgn
AbortDoc
PolyPolyline
FrameRgn
StretchBlt
FloodFill
SetGraphicsMode
PatBlt
SetPixel
SetBoundsRect
CreateCompatibleDC
FillPath
GetBkMode
Arc
GetWorldTransform
StartPage
GetWindowExtEx
SelectObject
Pie
ScaleWindowExtEx
ModifyWorldTransform
ExtTextOutA
SaveDC
PolylineTo
PolyTextOutA
BitBlt
GetBkColor
SetBrushOrgEx
CancelDC
RoundRect
SetDCPenColor
FillRgn
ExtTextOutW
SetTextCharacterExtra
StartDocW
WidenPath
EndPage
GetViewportOrgEx
IntersectClipRect
SetWorldTransform
CreateDCW
CreateFontW
GetDeviceCaps
GetTextMetricsW
DeleteDC
TextOutW
SetTextColor
DeleteObject
GetMapMode
SetTextAlign
GetStockObject
CreatePen
CreateSolidBrush
Polygon

winspool.drv

ClosePrinter
OpenPrinterW
EndDocPrinter
StartDocPrinterW
StartPagePrinter

advapi32

SetFileSecurityW
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegOpenKeyExW
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
RegCloseKey
SetSecurityDescriptorDacl
GetTokenInformation
CryptGetUserKey
GetUserNameW
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExA
OpenProcessToken
RegQueryValueExA
CryptGenRandom
CryptDecrypt
ConvertSidToStringSidA

shell32

SHGetSpecialFolderPathW
SHCreateDirectoryExW
SHCreateDirectoryExA

shlwapi

wnsprintfA
PathFindFileNameW
PathFileExistsA
SHSetValueA
PathAppendW
StrStrIW
PathFileExistsW
wvnsprintfW
SHSetValueW
SHDeleteValueA
StrToIntExA
PathFindFileNameA
wvnsprintfA
StrStrIA
wnsprintfW
PathAppendA
SHGetValueW

gdiplus

GdipDeleteGraphics
GdipCreateFromHDC
GdipFree
GdipDisposeImage
GdipGetImageWidth
GdipAlloc
GdipCloneImage
GdipGetImageHeight
GdipLoadImageFromFile
GdipDrawImageRectI
GdiplusShutdown
GdiplusStartup
GdipFillEllipseI

netapi32

NetApiBufferFree
NetUserGetInfo
Netbios

iphlpapi

GetAdaptersAddresses

ws2_32

inet_ntoa
gethostbyname
WSAGetLastError
setsockopt
htons
ioctlsocket
getnameinfo
shutdown
gethostname
recv
WSAWaitForMultipleEvents
connect
socket
inet_addr
WSASetLastError
WSACreateEvent
WSACloseEvent
closesocket
WSAIoctl
send
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
getpeername
getsockname
getsockopt
ntohs
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
bind

crypt32

CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertDuplicateCertificateContext

wldap32

ord117
ord27
ord145
ord208
ord216
ord41
ord14
ord46
ord26
ord219
ord301
ord147
ord133
ord79
ord142
ord167
ord127

psapi

GetModuleFileNameExW

ole32

CoCreateGuid

Exports

Exports

MSDetoursPrinterHook
MSDetoursPrinterUnHook

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 817KB - Virtual size: 816KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 74KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 144KB - Virtual size: 143KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/WinWebTools64.dll
.dll windows:5 windows x64 arch:x64

55fce7428cfd98bbbd7a7f20340e7d0d

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

ad:bc:38:4b:76:54:45:24:06:9b:31:c8:02:29:58:1a:a1:be:1c:7e:ac:f0:ae:25:f2:5a:e2:b3:5c:a6:f9:b5
Signer

Actual PE Digest

ad:bc:38:4b:76:54:45:24:06:9b:31:c8:02:29:58:1a:a1:be:1c:7e:ac:f0:ae:25:f2:5a:e2:b3:5c:a6:f9:b5

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\x64\WinWebTools64.pdb

Imports

kernel32

SystemTimeToTzSpecificLocalTime
DisableThreadLibraryCalls
GetModuleFileNameW
GetTickCount
SleepEx
GetCurrentProcessId
QueueUserAPC
RtlUnwind
GlobalMemoryStatus
ConvertThreadToFiber
DecodePointer
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
ConvertFiberToThread
MoveFileExW
CreateDirectoryW
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
SetConsoleCtrlHandler
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
CloseHandle
TerminateThread
SetEvent
Sleep
FindFirstFileExA
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetStringTypeW
GetACP
ReadConsoleW
GetConsoleMode
WriteConsoleW
GetFileType
GetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
ExitProcess
CreateEventW
WaitForSingleObject
TlsFree
TlsSetValue
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
ReadFile
QueryDosDeviceW
GetLogicalDrives
FindFirstFileW
HeapFree
SetLastError
FindNextFileW
WriteFile
lstrcpynW
DeviceIoControl
GetDriveTypeA
SetFilePointer
SetEndOfFile
GetTempPathW
FindClose
GetVolumeInformationA
CreateFileW
GetFileAttributesW
GetVersionExW
GetSystemDirectoryW
UnmapViewOfFile
GetModuleHandleA
OpenProcess
SetFileAttributesW
GetLastError
GetFileAttributesExW
CreateFileA
FileTimeToSystemTime
DeleteFileA
DeleteFileW
LoadLibraryW
HeapAlloc
GetProcAddress
LocalFree
GetProcessHeap
FreeLibrary
CreateFileMappingW
MapViewOfFile
LoadLibraryExW
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameA
GetFileSizeEx
OutputDebugStringA
GetSystemDirectoryA
SetFileAttributesA
GetLocalTime
SetFilePointerEx
GetFileSize
lstrlenW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
GetComputerNameW
GetPrivateProfileStringA
OpenFileMappingW
CreateMutexW
OpenMutexW
GetDriveTypeW
ReleaseMutex
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
DeleteCriticalSection
SystemTimeToFileTime
GetSystemTime
FormatMessageA
FlushFileBuffers
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
GetCurrentDirectoryW

user32

UnhookWindowsHookEx
SetWindowsHookExW
GetParent
CallNextHookEx
GetProcessWindowStation
wsprintfA
CharUpperW
GetUserObjectInformationW
GetForegroundWindow
MessageBoxW
GetWindowThreadProcessId
FindWindowW
GetWindowLongW
GetWindow
SendMessageTimeoutW
EnumChildWindows
RegisterWindowMessageA
EnumWindows
GetClassNameW

ole32

CoUninitialize
CoInitializeEx
CoInitialize

oleaut32

VariantClear
SysFreeString
VariantInit

shlwapi

wnsprintfA
StrToIntExA
PathAppendA
PathFileExistsA
SHGetValueW
PathMatchSpecW
wnsprintfW
StrCmpNIA
StrCmpW
PathFindFileNameW
PathFileExistsW
SHSetValueW
PathAppendW
PathFindFileNameA
SHSetValueA
wvnsprintfA
SHDeleteValueA

oleacc

WindowFromAccessibleObject
AccessibleObjectFromWindow
ObjectFromLresult

ws2_32

getpeername
getsockname
getsockopt
ntohs
WSAStartup
WSACleanup
__WSAFDIsSet
select
accept
htonl
WSASetLastError
WSACloseEvent
shutdown
WSAIoctl
bind
gethostname
inet_ntoa
WSAEventSelect
listen
getaddrinfo
freeaddrinfo
recvfrom
sendto
WSAEnumNetworkEvents
send
inet_addr
socket
connect
WSAGetLastError
setsockopt
htons
WSACreateEvent
recv
ioctlsocket
gethostbyname
getnameinfo
closesocket

psapi

GetModuleFileNameExW

crypt32

CertFreeCertificateContext
CertCloseStore
CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertDuplicateCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

wldap32

ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord41
ord208
ord216
ord14
ord46
ord219
ord145
ord301
ord147

advapi32

RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExW
RegOpenKeyExA
InitializeSecurityDescriptor
GetTokenInformation
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
RegCloseKey
SetFileSecurityW
ConvertSidToStringSidA
RegQueryValueExA
AllocateAndInitializeSid
SetEntriesInAclW
OpenProcessToken

shell32

SHCreateDirectoryExW
SHCreateDirectoryExA
SHGetSpecialFolderPathW

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 708KB - Virtual size: 708KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 69KB - Virtual size: 89KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 124KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ChromeR
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/imDec2.dll
.dll windows:5 windows x64 arch:x64

102d59612396817ab1114800b20abc39

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3e:f4:3d:c6:e0:26:dc:1a:3f:9c:76:dd:86:50:88:37:e0:8f:4f:96:51:b2:33:9e:37:f8:8e:07:e6:95:5b:c3
Signer

Actual PE Digest

3e:f4:3d:c6:e0:26:dc:1a:3f:9c:76:dd:86:50:88:37:e0:8f:4f:96:51:b2:33:9e:37:f8:8e:07:e6:95:5b:c3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\x64\imDec2.pdb

Imports

kernel32

Sleep
WaitForSingleObject
SleepEx
QueueUserAPC
CloseHandle
GetModuleHandleW
GlobalMemoryStatus
SystemTimeToTzSpecificLocalTime
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
GetEnvironmentVariableW
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
ConvertThreadToFiber
RtlUnwind
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableA
CompareFileTime
MoveFileExW
CreateDirectoryW
SetStdHandle
GetConsoleCP
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
SystemTimeToFileTime
GetLocalTime
LoadLibraryW
FileTimeToSystemTime
FindFirstFileExA
GetTimeZoneInformation
ReadConsoleW
GetConsoleMode
GetTimeFormatW
GetDateFormatW
GetACP
SetConsoleCtrlHandler
WriteConsoleW
GetFileType
GetStdHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
ExitProcess
InterlockedFlushSList
lstrlenW
DisableThreadLibraryCalls
GetLastError
FormatMessageW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetProcAddress
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
GetModuleFileNameA
GetFileSizeEx
WriteFile
OutputDebugStringA
CreateFileA
GetSystemDirectoryA
SetFileAttributesA
SetFilePointerEx
ReadFile
HeapFree
CreateFileW
HeapAlloc
GetFileSize
GetProcessHeap
GetLogicalDrives
FindFirstFileW
FindNextFileW
DeviceIoControl
GetDriveTypeA
SetFilePointer
SetEndOfFile
GetTempPathW
FindClose
GetVolumeInformationA
GetFileAttributesW
GetVersionExW
UnmapViewOfFile
GetModuleHandleA
OpenProcess
SetFileAttributesW
GetFileAttributesExW
DeleteFileA
DeleteFileW
LocalFree
FreeLibrary
CreateFileMappingW
MapViewOfFile
LoadLibraryExW
GetModuleFileNameW
OpenMutexW
OpenFileMappingW
CreateMutexW
InitializeCriticalSection
GetComputerNameW
GetPrivateProfileStringA
GetDriveTypeW
ReleaseMutex
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetSystemTime
FormatMessageA
FlushFileBuffers
TerminateThread
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetCurrentDirectoryW

user32

GetWindowTextW
GetProcessWindowStation
MessageBoxW
SystemParametersInfoW
GetDesktopWindow
EnumWindows
FindWindowExW
PostMessageW
wsprintfA
FindWindowW
GetClassNameW
GetUserObjectInformationW

ole32

CoInitialize
CoCreateInstance
CoUninitialize
CoInitializeEx

oleaut32

VariantInit
SysFreeString
VariantClear

shlwapi

PathFileExistsA
PathAppendA
SHDeleteValueA
SHSetValueW
PathFileExistsW
PathFindFileNameA
SHGetValueW
StrToIntExA
wnsprintfW
PathAppendW
SHSetValueA
wvnsprintfA
StrStrIW
StrCmpNW
wnsprintfA

oleacc

WindowFromAccessibleObject
AccessibleObjectFromWindow

ws2_32

gethostname
shutdown
WSAGetLastError
setsockopt
htons
recv
getnameinfo
ioctlsocket
sendto
recvfrom
freeaddrinfo
connect
socket
inet_addr
WSASetLastError
WSACreateEvent
WSACloseEvent
closesocket
WSAIoctl
inet_ntoa
getaddrinfo
gethostbyname
bind
listen
htonl
accept
select
__WSAFDIsSet
send
WSAEnumNetworkEvents
WSAEventSelect
getpeername
getsockname
getsockopt
ntohs
WSAStartup
WSACleanup

crypt32

CertFindCertificateInStore
CertOpenStore
CertEnumCertificatesInStore
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertGetEnhancedKeyUsage
CertFreeCertificateContext
CertCloseStore

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

wldap32

ord79
ord145
ord133
ord219
ord46
ord14
ord216
ord208
ord41
ord117
ord147
ord301
ord167
ord26
ord27
ord127
ord142

advapi32

GetTokenInformation
RegQueryValueExW
ConvertSidToStringSidW
RegOpenKeyExW
RegOpenKeyExA
InitializeSecurityDescriptor
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource
ConvertStringSecurityDescriptorToSecurityDescriptorW
SetSecurityDescriptorDacl
RegCloseKey
SetFileSecurityW
RegQueryValueExA
AllocateAndInitializeSid
SetEntriesInAclW
OpenProcessToken

shell32

SHCreateDirectoryExW
SHCreateDirectoryExA
SHGetSpecialFolderPathW

Exports

Exports

StartMonitorWeChat
StartMonitorWhatsApp
StopMonitorWeChat
StopMonitorWhatsApp

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 741KB - Virtual size: 741KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 71KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 128KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
x64/imDec3.dll
.dll windows:5 windows x64 arch:x64

4cebc0fa065c9e855dd33a2d37473eed

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

02/03/2023, 00:00

Not After

02/05/2026, 23:59

Subject

SERIALNUMBER=91370100306819342R,CN=Shandong Anzai Information Technology CO.\,Ltd.,O=Shandong Anzai Information Technology CO.\,Ltd.,L=济南市,ST=山东省,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c21e6b58ee58d97e9ab98e696b0e68a80e69cafe4baa7e4b89ae5bc80e58f91e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e5b1b1e4b89ce79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

1b:25:62:ed:b0:51:e5:f2:fc:fa:29:55:74:6f:73:81:b3:e8:f0:18:3f:17:89:00:94:d3:a6:c4:64:8e:bd:70
Signer

Actual PE Digest

1b:25:62:ed:b0:51:e5:f2:fc:fa:29:55:74:6f:73:81:b3:e8:f0:18:3f:17:89:00:94:d3:a6:c4:64:8e:bd:70

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\NSecsoft\NSec\Release\Client\x64\imDec3.pdb

Imports

kernel32

LoadLibraryW
DisableThreadLibraryCalls
SystemTimeToFileTime
FileTimeToSystemTime
lstrlenW
GetLocalTime
Sleep
GetModuleFileNameW
LoadLibraryExW
FreeLibrary
GetModuleHandleW
GetProcAddress
CreateFileMappingW
GetFileSize
UnmapViewOfFile
SetFilePointer
WriteFile
VirtualQuery
SetThreadContext
FlushInstructionCache
GetThreadContext
GetCurrentThread
SuspendThread
GetCurrentThreadId
GetCurrentProcess
VirtualFree
VirtualProtect
VirtualQueryEx
ExitProcess
SystemTimeToTzSpecificLocalTime
VirtualProtectEx
CloseHandle
GetLastError
OpenProcess
ResumeThread
GlobalMemoryStatus
ConvertThreadToFiber
ConvertFiberToThread
CreateFiber
SwitchToFiber
DeleteFiber
GetVersion
ReadConsoleA
SetConsoleMode
VerifyVersionInfoW
VerSetConditionMask
VirtualAlloc
RtlUnwind
PeekNamedPipe
WaitForMultipleObjects
CompareFileTime
MoveFileExW
CreateDirectoryW
SetStdHandle
GetConsoleCP
GetTimeZoneInformation
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
FindNextFileA
WaitForSingleObject
GetEnvironmentVariableA
GetEnvironmentVariableW
TerminateProcess
FindFirstFileExA
ReadConsoleW
GetConsoleMode
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
GetACP
FreeLibraryAndExitThread
ExitThread
CreateThread
WriteConsoleW
GetModuleHandleExW
GetFileType
GetStdHandle
InterlockedFlushSList
RaiseException
RtlPcToFileHeader
RtlUnwindEx
SetLastError
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
FormatMessageW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetTickCount
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetStringTypeW
GetCPInfo
GetModuleFileNameA
GetFileSizeEx
OutputDebugStringA
CreateFileA
GetSystemDirectoryA
SetFileAttributesA
SetFilePointerEx
ReadFile
HeapFree
CreateFileW
HeapAlloc
GetProcessHeap
SetFileAttributesW
GetLogicalDrives
FindFirstFileW
FindNextFileW
DeviceIoControl
GetDriveTypeA
SetEndOfFile
GetTempPathW
FindClose
GetVolumeInformationA
GetFileAttributesW
GetVersionExW
GetModuleHandleA
GetFileAttributesExW
DeleteFileA
DeleteFileW
LocalFree
MapViewOfFile
OpenMutexW
OpenFileMappingW
CreateMutexW
GetDriveTypeW
InitializeCriticalSection
GetComputerNameW
GetPrivateProfileStringA
ReleaseMutex
AreFileApisANSI
TryEnterCriticalSection
HeapCreate
GetFullPathNameW
GetDiskFreeSpaceW
LockFile
GetFullPathNameA
UnlockFileEx
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
OutputDebugStringW
FlushViewOfFile
LoadLibraryA
WaitForSingleObjectEx
GetVersionExA
HeapReAlloc
GetSystemInfo
HeapCompact
HeapDestroy
UnlockFile
CreateFileMappingA
LockFileEx
GetSystemTime
FormatMessageA
FlushFileBuffers
TerminateThread
QueueUserAPC
SleepEx
GetCurrentDirectoryW

user32

FindWindowW
GetProcessWindowStation
MessageBoxW
wsprintfA
EnumChildWindows
GetClassNameW
GetWindowTextW
GetUserObjectInformationW

ole32

CoUninitialize
CoInitializeEx

oleaut32

SysFreeString
VariantClear
VariantInit

shlwapi

PathAppendA
SHDeleteValueA
StrToIntExA
PathFileExistsA
PathAppendW
SHSetValueW
PathFileExistsW
StrStrIW
wnsprintfA
SHGetValueW
wvnsprintfA
SHSetValueA
PathFindFileNameA
wnsprintfW
StrCmpNW
PathFindFileNameW
StrCmpW

oleacc

AccessibleObjectFromWindow
WindowFromAccessibleObject

ws2_32

closesocket
shutdown
getnameinfo
ioctlsocket
WSAGetLastError
setsockopt
htons
recv
connect
socket
inet_addr
sendto
recvfrom
freeaddrinfo
WSASetLastError
WSACreateEvent
WSACloseEvent
WSAIoctl
bind
inet_ntoa
gethostbyname
gethostname
WSACleanup
getaddrinfo
listen
htonl
accept
select
send
WSAEnumNetworkEvents
WSAEventSelect
getpeername
getsockname
getsockopt
ntohs
WSAStartup
__WSAFDIsSet

crypt32

CertFreeCertificateContext
CertCloseStore
CertDuplicateCertificateContext
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreW
CertGetCertificateContextProperty
CertFindCertificateInStore

netapi32

Netbios

iphlpapi

GetAdaptersAddresses

wldap32

ord142
ord145
ord219
ord46
ord14
ord216
ord147
ord301
ord79
ord133
ord127
ord208
ord41
ord117
ord26
ord27
ord167

advapi32

SetFileSecurityW
RegCloseKey
SetSecurityDescriptorDacl
GetTokenInformation
RegQueryValueExW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
RegOpenKeyExW
RegOpenKeyExA
InitializeSecurityDescriptor
OpenProcessToken
SetEntriesInAclW
AllocateAndInitializeSid
RegQueryValueExA
CryptGenRandom
CryptDecrypt
CryptCreateHash
CryptSetHashParam
CryptSignHashW
CryptDestroyHash
CryptExportKey
CryptGetUserKey
CryptAcquireContextW
CryptGetProvParam
CryptDestroyKey
CryptReleaseContext
CryptEnumProvidersW
RegisterEventSourceW
ReportEventW
DeregisterEventSource

shell32

SHCreateDirectoryExW
SHGetSpecialFolderPathW
SHCreateDirectoryExA

Exports

Exports

DllMain

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 722KB - Virtual size: 722KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 71KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 127KB - Virtual size: 127KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

61259b55b8912888e90f516ca08dc514

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9cCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

5b:5a:5b:1a:c4:09:3e:49:e8:f0:91:15:6a:7b:1a:b7:d8:da:50:8f:7f:f2:a2:99:6b:70:b0:54:81:d1:fa:7bSigner

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 128KB

.ndata Size: - Virtual size: 80KB

.rsrc Size: 267KB - Virtual size: 266KB

4b45b7e00344a87332fbd12653854d1a

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

shell32

comdlg32

ole32

Exports

Exports

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 19KB

.rsrc Size: 512B - Virtual size: 152B

.reloc Size: 1KB - Virtual size: 1KB

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 1024B - Virtual size: 867B

.data Size: 512B - Virtual size: 120B

.reloc Size: 1024B - Virtual size: 662B

c1c7505e1e6e929ebb6b9100e55b050a

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

user32

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

06:4a:10:0b:70:a4:c5:fd:f8:0c:47:e3:4a:7a:de:9c
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

5b:5a:5b:1a:c4:09:3e:49:e8:f0:91:15:6a:7b:1a:b7:d8:da:50:8f:7f:f2:a2:99:6b:70:b0:54:81:d1:fa:7b
Signer

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 128KB

.ndata
Size: - Virtual size: 80KB

.rsrc
Size: 267KB - Virtual size: 266KB

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 19KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 1024B - Virtual size: 867B

.data
Size: 512B - Virtual size: 120B

.reloc
Size: 1024B - Virtual size: 662B

.text
Size: 3KB - Virtual size: 3KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 420B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

33:65:50:08:79:ad:73:e2:30:b9:e0:1d:0d:7f:ac:91
Certificate

47:97:4d:78:73:a5:bc:ab:0d:2f:b3:70:19:2f:ce:5e
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

75:2e:2e:f9:2b:c4:bb:5e:a1:b5:e3:da:a3:1d:57:59
Certificate

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

02:47:56:ba:fd:87:06:a3:6e:31:7a:d8:19:38:2f:16
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

91:bd:56:d3:df:ac:02:c9:00:ae:cf:57:7b:32:0a:ae:cf:ba:be:89:61:8e:63:ac:79:76:59:61:57:a8:ce:bb
Signer

91:bd:56:d3:df:ac:02:c9:00:ae:cf:57:7b:32:0a:ae:cf:ba:be:89:61:8e:63:ac:79:76:59:61:57:a8:ce:bb
Signer

91:bd:56:d3:df:ac:02:c9:00:ae:cf:57:7b:32:0a:ae:cf:ba:be:89:61:8e:63:ac:79:76:59:61:57:a8:ce:bb
Signer

a5:50:9e:be:e0:d2:28:5e:37:19:03:8e:78:65:2b:ef:8e:c4:b9:df
Signer