JaffaCakes118_8f53c4425f6546c0570e1893297ebc337d01017cc188803e303c53d106ebc501

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_8f53c4425f6546c0570e1893297ebc337d01017cc188803e303c53d106ebc501
Size

24.6MB
MD5

3e2f78eec8345e7f02e222c6e9269c91
SHA1

a18ee3d2a5bb9e779258c22e06d8ff16f0adc37e
SHA256

8f53c4425f6546c0570e1893297ebc337d01017cc188803e303c53d106ebc501
SHA512

356c7d03c957bbeaa245439750bc1624b3c1d10b4212ae3d8d9b78685405a4ed4293cff352592dc422e00914a0d925b4d491a7fcb96dd7ccd14daedf8812d715
SSDEEP

393216:E6Obvej1Z4DrJjMo6xvSCylTYo+mPnbRGi7nbvryfWh/T0P7HxdbyVfm:TQvepZCrxT6x97QbRGKLrcWRC7RxyVfm

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack002/$PLUGINSDIR/Math.dll
unpack002/$PLUGINSDIR/System.dll
unpack002/dbdump.dll
unpack002/libbrotlicommon.dll
unpack002/libidn2-0.dll
unpack002/libpangoft2-1.0-0.dll
unpack002/msado25.tlb

Files

JaffaCakes118_8f53c4425f6546c0570e1893297ebc337d01017cc188803e303c53d106ebc501
.zip

Password: infected
e2f85c3eb27695e55e3377d8695f66791dc80a6cbb7b9b059b365c58b5b49d16
.exe windows:4 windows x86 arch:x86

61259b55b8912888e90f516ca08dc514

Code Sign

64:96:8c:d9:a4:2a:e7:60
Certificate

Issuer

CN=Unquashed Undawning\ ,O=Klovneriernes,L=Tüttleben,ST=Thüringen,C=DE

Not Before

10-12-2021 14:52

Not After

09-12-2024 14:52

Subject

CN=Unquashed Undawning\ ,O=Klovneriernes,L=Tüttleben,ST=Thüringen,C=DE

aa:93:02:37:45:a9:52:9e:fa:18:52:7c:59:c1:77:6d:c0:e5:1d:f0
Signer

Actual PE Digest

aa:93:02:37:45:a9:52:9e:fa:18:52:7c:59:c1:77:6d:c0:e5:1d:f0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 260KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/Math.dll
.dll windows:4 windows x86 arch:x86

82274a6f12e4098899c6a675f5ce59d0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

HeapFree
lstrcmpW
lstrlenW
GlobalFree
lstrcatW
GlobalAlloc
lstrcpynW
WideCharToMultiByte
MultiByteToWideChar
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetCommandLineA
GetVersion
RaiseException
GetProcAddress
GetModuleHandleA
ExitProcess
TerminateProcess
GetCurrentProcess
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
lstrcpyW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
GetCPInfo
GetACP
GetEnvironmentStrings
GetEnvironmentStringsW
WriteFile
GetLastError
SetFilePointer
HeapAlloc
VirtualAlloc
HeapReAlloc
LCMapStringA
GetStringTypeW
GetOEMCP
LoadLibraryA
GetStringTypeA
FlushFileBuffers
CloseHandle
LCMapStringW
SetStdHandle
RtlUnwind

Exports

Exports

Script

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfW

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 662B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Airways_8.bmp
.jpg
ArtDeco_brown_21.bmp
.jpg
Calced/Perquadrat/ArtDeco_brown_21.bmp
.jpg
Calced/Perquadrat/Sigtes.Afs
Corbelled.Xen
GameVisualPlugin.dll
.dll windows:6 windows x64 arch:x64

ab8abcc1f30df0aad1e517f3b4de4618

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19-09-2018 00:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15-06-2016 00:00

Not After

15-06-2024 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:b5:c7:f8:c1:8a:7a:2b:fb:b5:27:46
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

04-06-2019 05:45

Not After

04-06-2022 05:45

Subject

SERIALNUMBER=23638777,CN=ASUSTEK COMPUTER INCORPORATION,O=ASUSTEK COMPUTER INCORPORATION,STREET=4F\, NO. 150\, LI-TE RD.\, PEI TOU,L=TAIPEI,ST=TAIPEI,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

79:62:5a:c1:68:27:c5:a9:48:1c:6a:05:20:39:4b:ac:9b:92:1f:12:0b:9c:72:61:46:e9:09:44:33:d7:e5:bb
Signer

Actual PE Digest

79:62:5a:c1:68:27:c5:a9:48:1c:6a:05:20:39:4b:ac:9b:92:1f:12:0b:9c:72:61:46:e9:09:44:33:d7:e5:bb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\SourceCode\gc3.gamevisual\production_V4.2\Service\ServiceSDK\Release\GameVisualPlugin\GameVisualPlugin.pdb

Imports

kernel32

SetHandleInformation
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateProcessW
GetExitCodeProcess
PeekNamedPipe
ReadFile
FindFirstFileW
FindNextFileW
InitializeCriticalSectionEx
DeleteCriticalSection
WriteFile
WideCharToMultiByte
lstrlenW
SetLastError
CreatePipe
LeaveCriticalSection
InitializeCriticalSection
FreeLibrary
LocalAlloc
GetSystemDirectoryW
LoadLibraryExW
VerifyVersionInfoW
VerSetConditionMask
GetFullPathNameW
GetPrivateProfileStringW
GetPrivateProfileIntW
Sleep
OutputDebugStringW
ReleaseMutex
WaitForSingleObject
WritePrivateProfileStringW
CreateDirectoryW
GetEnvironmentVariableW
InitializeCriticalSectionAndSpinCount
CreateMutexW
GetProcAddress
LoadLibraryW
LocalFree
GetLastError
MultiByteToWideChar
GetModuleHandleW
GetFileAttributesW
DeleteFileW
CopyFileW
GetModuleFileNameW
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateFileW
EnterCriticalSection
DeviceIoControl
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess

user32

wsprintfW
SetDisplayConfig
SendMessageW
GetWindowRect
GetClientRect
BeginPaint
GetSystemMetrics
CreateWindowExW
QueryDisplayConfig
GetDisplayConfigBufferSizes
PostMessageW
FindWindowW
RegisterDeviceNotificationW
ChangeWindowMessageFilterEx
SendMessageTimeoutW
RegisterWindowMessageW
DispatchMessageW
TranslateMessage
GetMessageW
SetForegroundWindow
UpdateWindow
SetWindowPos
ShowWindow
EndPaint
DefWindowProcW
PostQuitMessage
RegisterClassW

gdi32

GetStockObject

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegEnumKeyExW
RegOpenKeyExW
RegDeleteKeyExW
RegCloseKey
RegSetKeyValueW
RegCreateKeyExW
GetUserNameW

shell32

ShellExecuteW

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize
CoSetProxyBlanket

oleaut32

SysFreeString
SysAllocString
VariantClear

gamevisualplugin.helper

RemoveGameVisualAppxPackage

mscms

WcsGetCalibrationManagementState
WcsSetCalibrationManagementState

mfc140u

ord2158
ord266
ord2346
ord2350
ord1489
ord265
ord1491
ord2159

shlwapi

PathFileExistsW

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiBuildDriverInfoList
SetupDiEnumDriverInfoW
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

msvcp140

?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
_Cnd_do_broadcast_at_thread_exit
?_Xout_of_range@std@@YAXPEBD@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Strcoll
_Strxfrm
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@D@std@@2V0locale@2@A
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$collate@D@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ

gdiplus

GdiplusStartup
GdipDrawEllipseI
GdipDrawRectangleI
GdipDrawLineI
GdipDeleteGraphics
GdipCreateFromHDC
GdipDeletePen
GdipCreatePen1
GdiplusShutdown

wininet

InternetReadFile
InternetOpenUrlW
HttpQueryInfoW
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetOpenW
InternetCloseHandle

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec
PathAllocCombine

wtsapi32

WTSRegisterSessionNotification

vcruntime140

__std_type_info_compare
strstr
strrchr
strchr
_purecall
_CxxThrowException
__CxxFrameHandler3
memcmp
wcsrchr
memmove
memset
__C_specific_handler
__std_type_info_destroy_list
__std_exception_copy
__std_terminate
wcsstr
memcpy
__std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

realloc
malloc
calloc
free
_recalloc

api-ms-win-crt-string-l1-1-0

strcat_s
strcpy_s
_wcsnicmp
towlower
wcstok_s
isalpha
strncmp
wcscpy_s
isdigit
wcscat_s
wcsncpy_s
_wcsicmp

api-ms-win-crt-runtime-l1-1-0

_beginthreadex
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
_errno
_initterm_e
_invalid_parameter_noinfo
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv

api-ms-win-crt-convert-l1-1-0

wcstol
_wtoi
atoi
strtoll
strtoull
strtod

api-ms-win-crt-stdio-l1-1-0

fflush
__acrt_iob_func
fopen_s
fclose
__stdio_common_vsprintf_s
__stdio_common_vswprintf
__stdio_common_vfprintf
__stdio_common_vswprintf_s
fread
fwrite
_wfopen_s
_fseeki64
_ftelli64
__stdio_common_vsprintf

api-ms-win-crt-time-l1-1-0

_mktime64
wcsftime
_localtime64_s
_time64
_utime64

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-math-l1-1-0

_dclass
ceilf

Exports

Exports

QueryLibrary

Sections

.text
Size: 259KB - Virtual size: 258KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Mythogeneses/Highlandish/Tagalogs/Hulslib114/GameVisualPlugin.dll
.dll windows:6 windows x64 arch:x64

ab8abcc1f30df0aad1e517f3b4de4618

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

Issuer

CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE

Not Before

19-09-2018 00:00

Not After

28-01-2028 12:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

15-06-2016 00:00

Not After

15-06-2024 00:00

Subject

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageOCSPSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

32:b5:c7:f8:c1:8a:7a:2b:fb:b5:27:46
Certificate

Issuer

CN=GlobalSign Extended Validation CodeSigning CA - SHA256 - G3,O=GlobalSign nv-sa,C=BE

Not Before

04-06-2019 05:45

Not After

04-06-2022 05:45

Subject

SERIALNUMBER=23638777,CN=ASUSTEK COMPUTER INCORPORATION,O=ASUSTEK COMPUTER INCORPORATION,STREET=4F\, NO. 150\, LI-TE RD.\, PEI TOU,L=TAIPEI,ST=TAIPEI,C=TW,1.3.6.1.4.1.311.60.2.1.3=#13025457,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

79:62:5a:c1:68:27:c5:a9:48:1c:6a:05:20:39:4b:ac:9b:92:1f:12:0b:9c:72:61:46:e9:09:44:33:d7:e5:bb
Signer

Actual PE Digest

79:62:5a:c1:68:27:c5:a9:48:1c:6a:05:20:39:4b:ac:9b:92:1f:12:0b:9c:72:61:46:e9:09:44:33:d7:e5:bb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

D:\SourceCode\gc3.gamevisual\production_V4.2\Service\ServiceSDK\Release\GameVisualPlugin\GameVisualPlugin.pdb

Imports

kernel32

SetHandleInformation
GetCurrentDirectoryW
SetCurrentDirectoryW
CreateProcessW
GetExitCodeProcess
PeekNamedPipe
ReadFile
FindFirstFileW
FindNextFileW
InitializeCriticalSectionEx
DeleteCriticalSection
WriteFile
WideCharToMultiByte
lstrlenW
SetLastError
CreatePipe
LeaveCriticalSection
InitializeCriticalSection
FreeLibrary
LocalAlloc
GetSystemDirectoryW
LoadLibraryExW
VerifyVersionInfoW
VerSetConditionMask
GetFullPathNameW
GetPrivateProfileStringW
GetPrivateProfileIntW
Sleep
OutputDebugStringW
ReleaseMutex
WaitForSingleObject
WritePrivateProfileStringW
CreateDirectoryW
GetEnvironmentVariableW
InitializeCriticalSectionAndSpinCount
CreateMutexW
GetProcAddress
LoadLibraryW
LocalFree
GetLastError
MultiByteToWideChar
GetModuleHandleW
GetFileAttributesW
DeleteFileW
CopyFileW
GetModuleFileNameW
CloseHandle
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateFileW
EnterCriticalSection
DeviceIoControl
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess

user32

wsprintfW
SetDisplayConfig
SendMessageW
GetWindowRect
GetClientRect
BeginPaint
GetSystemMetrics
CreateWindowExW
QueryDisplayConfig
GetDisplayConfigBufferSizes
PostMessageW
FindWindowW
RegisterDeviceNotificationW
ChangeWindowMessageFilterEx
SendMessageTimeoutW
RegisterWindowMessageW
DispatchMessageW
TranslateMessage
GetMessageW
SetForegroundWindow
UpdateWindow
SetWindowPos
ShowWindow
EndPaint
DefWindowProcW
PostQuitMessage
RegisterClassW

gdi32

GetStockObject

advapi32

InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegEnumKeyExW
RegOpenKeyExW
RegDeleteKeyExW
RegCloseKey
RegSetKeyValueW
RegCreateKeyExW
GetUserNameW

shell32

ShellExecuteW

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize
CoSetProxyBlanket

oleaut32

SysFreeString
SysAllocString
VariantClear

gamevisualplugin.helper

RemoveGameVisualAppxPackage

mscms

WcsGetCalibrationManagementState
WcsSetCalibrationManagementState

mfc140u

ord2158
ord266
ord2346
ord2350
ord1489
ord265
ord1491
ord2159

shlwapi

PathFileExistsW

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiEnumDeviceInfo
SetupDiGetDeviceInstallParamsW
SetupDiSetDeviceInstallParamsW
SetupDiBuildDriverInfoList
SetupDiEnumDriverInfoW
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList

msvcp140

?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Locinfo@std@@QEAA@XZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??Bid@locale@std@@QEAA_KXZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
??0facet@locale@std@@IEAA@_K@Z
??1facet@locale@std@@MEAA@XZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
?_Throw_Cpp_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
_Cnd_do_broadcast_at_thread_exit
?_Xout_of_range@std@@YAXPEBD@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
_Strcoll
_Strxfrm
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?id@?$ctype@D@std@@2V0locale@2@A
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$collate@D@std@@2V0locale@2@A
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ

gdiplus

GdiplusStartup
GdipDrawEllipseI
GdipDrawRectangleI
GdipDrawLineI
GdipDeleteGraphics
GdipCreateFromHDC
GdipDeletePen
GdipCreatePen1
GdiplusShutdown

wininet

InternetReadFile
InternetOpenUrlW
HttpQueryInfoW
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetOpenW
InternetCloseHandle

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec
PathAllocCombine

wtsapi32

WTSRegisterSessionNotification

vcruntime140

__std_type_info_compare
strstr
strrchr
strchr
_purecall
_CxxThrowException
__CxxFrameHandler3
memcmp
wcsrchr
memmove
memset
__C_specific_handler
__std_type_info_destroy_list
__std_exception_copy
__std_terminate
wcsstr
memcpy
__std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-heap-l1-1-0

realloc
malloc
calloc
free
_recalloc

api-ms-win-crt-string-l1-1-0

strcat_s
strcpy_s
_wcsnicmp
towlower
wcstok_s
isalpha
strncmp
wcscpy_s
isdigit
wcscat_s
wcsncpy_s
_wcsicmp

api-ms-win-crt-runtime-l1-1-0

_beginthreadex
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
_errno
_initterm_e
_invalid_parameter_noinfo
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv

api-ms-win-crt-convert-l1-1-0

wcstol
_wtoi
atoi
strtoll
strtoull
strtod

api-ms-win-crt-stdio-l1-1-0

fflush
__acrt_iob_func
fopen_s
fclose
__stdio_common_vsprintf_s
__stdio_common_vswprintf
__stdio_common_vfprintf
__stdio_common_vswprintf_s
fread
fwrite
_wfopen_s
_fseeki64
_ftelli64
__stdio_common_vsprintf

api-ms-win-crt-time-l1-1-0

_mktime64
wcsftime
_localtime64_s
_time64
_utime64

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-math-l1-1-0

_dclass
ceilf

Exports

Exports

QueryLibrary

Sections

.text
Size: 259KB - Virtual size: 258KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 828B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Mythogeneses/Highlandish/Tagalogs/Hulslib114/StartNE.exe
.exe windows:5 windows x86 arch:x86

776e204b0fa32777af4a5881ea7474ac

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4d:7a:5e:95:c9:2e:17:b8:e5:b3:1a:2b:d0:45:3a:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14-04-2015 00:00

Not After

13-07-2018 23:59

Subject

CN=Nero AG,O=Nero AG,L=Karlsruhe,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:7a:5e:95:c9:2e:17:b8:e5:b3:1a:2b:d0:45:3a:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14-04-2015 00:00

Not After

13-07-2018 23:59

Subject

CN=Nero AG,O=Nero AG,L=Karlsruhe,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12-01-2016 00:00

Not After

11-04-2027 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G1,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

ab:97:ef:98:5f:a0:a4:b7:4f:c2:92:14:4d:8a:e4:b0:40:0e:ef:2f:b8:4d:3d:50:81:9a:47:e9:fe:82:21:75
Signer

Actual PE Digest

ab:97:ef:98:5f:a0:a4:b7:4f:c2:92:14:4d:8a:e4:b0:40:0e:ef:2f:b8:4d:3d:50:81:9a:47:e9:fe:82:21:75

Digest Algorithm

sha256

PE Digest Matches

true

9f:ae:83:b4:bf:a6:d8:cb:44:fd:c3:63:bc:4a:0f:06:4b:eb:d4:10
Signer

Actual PE Digest

9f:ae:83:b4:bf:a6:d8:cb:44:fd:c3:63:bc:4a:0f:06:4b:eb:d4:10

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Builds\78\N2\HO_NBR_g_2016_r_2016\Sources\Nero\bin\Release\StartNE.pdb

Imports

kernel32

GetModuleFileNameW
WaitForSingleObject
CloseHandle
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
IsDebuggerPresent
DecodePointer
EncodePointer
GetCurrentThreadId

user32

MessageBoxW

shell32

ShellExecuteExW

msvcp110

?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z

msvcr110

_wmakepath_s
_vswprintf_c_l
_purecall
??1type_info@@UAE@XZ
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
_XcptFilter
_wsplitpath_s
_amsg_exit
__wgetmainargs
__set_app_type
??2@YAPAXI@Z
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_wcmdln
_fmode
_commode
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
?terminate@@YAXXZ
_except_handler4_common
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
memmove
??3@YAXPAX@Z
exit
_CxxThrowException
__CxxFrameHandler3
memcpy
__crtGetShowWindowMode
memset

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 530KB - Virtual size: 529KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Mythogeneses/Highlandish/Tagalogs/Hulslib114/System.IO.Compression.FileSystem.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:8b:4c:06:71:0c:20:2c:df:3b:00:00:00:00:00:8b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07-10-2015 18:14

Not After

07-01-2017 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-06-2015 17:42

Not After

04-09-2016 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01-10-2014 18:11

Not After

01-01-2016 18:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f4:29:1f:1e:d5:a1:d5:10:c6:f2:46:10:4b:3d:4b:a1:71:35:2b:c6:9d:7d:18:4a:30:de:7a:b4:4c:5e:dd:98
Signer

Actual PE Digest

f4:29:1f:1e:d5:a1:d5:10:c6:f2:46:10:4b:3d:4b:a1:71:35:2b:c6:9d:7d:18:4a:30:de:7a:b4:4c:5e:dd:98

Digest Algorithm

sha256

PE Digest Matches

true

50:34:94:80:21:9d:4b:b1:b6:de:ce:c7:d2:2e:81:76:80:e0:98:30
Signer

Actual PE Digest

50:34:94:80:21:9d:4b:b1:b6:de:ce:c7:d2:2e:81:76:80:e0:98:30

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Nedvrdiges/Lejlighedsdigte149/Lndelen192/Runt/Airways_8.bmp
.jpg
Pseudogeneral/Rigsaeble/Droned/Miksende/huskattes.Eks
Sellerier/System.Text.Encoding.CodePages.dll
.dll windows:4 windows x64 arch:x64

Code Sign

33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11-02-2021 20:09

Not After

10-02-2022 20:09

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:84:5d:26:24:89:d7:06:21:45:93:dc:6d:6b:b2:22:5e:ba:c1:c0:f3:dd:d3:30:1a:36:9c:a3:e2:c8:43:b7
Signer

Actual PE Digest

cf:84:5d:26:24:89:d7:06:21:45:93:dc:6d:6b:b2:22:5e:ba:c1:c0:f3:dd:d3:30:1a:36:9c:a3:e2:c8:43:b7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

System.Text.Encoding.CodePages.ni.pdb
D:\a\_work\1\s\artifacts\obj\System.Text.Encoding.CodePages\net6.0-windows-Release\System.Text.Encoding.CodePages.pdb

Sections

.text
Size: 830KB - Virtual size: 830KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Sellerier/System.ValueTuple.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11-02-2021 20:09

Not After

10-02-2022 20:09

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:f0:3e:7d:67:d7:db:e7:f0:15:70:7b:d2:90:87:6f:12:dd:6a:0d:61:62:82:9b:9b:d6:67:68:49:3e:a2:00
Signer

Actual PE Digest

62:f0:3e:7d:67:d7:db:e7:f0:15:70:7b:d2:90:87:6f:12:dd:6a:0d:61:62:82:9b:9b:d6:67:68:49:3e:a2:00

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\artifacts\obj\System.ValueTuple\net6.0-Release\System.ValueTuple.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Sellerier/application-x-firmware-symbolic.svg
Sellerier/audio-speakers-symbolic.symbolic.png
.png
Sellerier/camera-hardware-disabled-symbolic.svg
Sellerier/computer.png
.png
Sellerier/config.model.xml
.xml
Sigtes.Afs
StartNE.exe
.exe windows:5 windows x86 arch:x86

776e204b0fa32777af4a5881ea7474ac

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4d:7a:5e:95:c9:2e:17:b8:e5:b3:1a:2b:d0:45:3a:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14-04-2015 00:00

Not After

13-07-2018 23:59

Subject

CN=Nero AG,O=Nero AG,L=Karlsruhe,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:7a:5e:95:c9:2e:17:b8:e5:b3:1a:2b:d0:45:3a:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14-04-2015 00:00

Not After

13-07-2018 23:59

Subject

CN=Nero AG,O=Nero AG,L=Karlsruhe,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12-01-2016 00:00

Not After

11-04-2027 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G1,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

ab:97:ef:98:5f:a0:a4:b7:4f:c2:92:14:4d:8a:e4:b0:40:0e:ef:2f:b8:4d:3d:50:81:9a:47:e9:fe:82:21:75
Signer

Actual PE Digest

ab:97:ef:98:5f:a0:a4:b7:4f:c2:92:14:4d:8a:e4:b0:40:0e:ef:2f:b8:4d:3d:50:81:9a:47:e9:fe:82:21:75

Digest Algorithm

sha256

PE Digest Matches

true

9f:ae:83:b4:bf:a6:d8:cb:44:fd:c3:63:bc:4a:0f:06:4b:eb:d4:10
Signer

Actual PE Digest

9f:ae:83:b4:bf:a6:d8:cb:44:fd:c3:63:bc:4a:0f:06:4b:eb:d4:10

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Builds\78\N2\HO_NBR_g_2016_r_2016\Sources\Nero\bin\Release\StartNE.pdb

Imports

kernel32

GetModuleFileNameW
WaitForSingleObject
CloseHandle
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
IsDebuggerPresent
DecodePointer
EncodePointer
GetCurrentThreadId

user32

MessageBoxW

shell32

ShellExecuteExW

msvcp110

?_Xbad_alloc@std@@YAXXZ
?_Winerror_map@std@@YAPBDH@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z

msvcr110

_wmakepath_s
_vswprintf_c_l
_purecall
??1type_info@@UAE@XZ
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
_XcptFilter
_wsplitpath_s
_amsg_exit
__wgetmainargs
__set_app_type
??2@YAPAXI@Z
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_wcmdln
_fmode
_commode
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
?terminate@@YAXXZ
_except_handler4_common
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
memmove
??3@YAXPAX@Z
exit
_CxxThrowException
__CxxFrameHandler3
memcpy
__crtGetShowWindowMode
memset

Sections

.text
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 530KB - Virtual size: 529KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
System.IO.Compression.FileSystem.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:8b:4c:06:71:0c:20:2c:df:3b:00:00:00:00:00:8b
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07-10-2015 18:14

Not After

07-01-2017 18:14

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:728D-C45F-F9EB,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:0a:2c:79:ae:d7:79:7b:a6:ac:00:01:00:00:01:0a
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04-06-2015 17:42

Not After

04-09-2016 17:42

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31-08-2010 22:19

Not After

31-08-2020 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03-04-2007 12:53

Not After

03-04-2021 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:38:8d:23:6d:16:27:a3:26:e0:00:00:00:00:00:38
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

01-10-2014 18:11

Not After

01-01-2016 18:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f4:29:1f:1e:d5:a1:d5:10:c6:f2:46:10:4b:3d:4b:a1:71:35:2b:c6:9d:7d:18:4a:30:de:7a:b4:4c:5e:dd:98
Signer

Actual PE Digest

f4:29:1f:1e:d5:a1:d5:10:c6:f2:46:10:4b:3d:4b:a1:71:35:2b:c6:9d:7d:18:4a:30:de:7a:b4:4c:5e:dd:98

Digest Algorithm

sha256

PE Digest Matches

true

50:34:94:80:21:9d:4b:b1:b6:de:ce:c7:d2:2e:81:76:80:e0:98:30
Signer

Actual PE Digest

50:34:94:80:21:9d:4b:b1:b6:de:ce:c7:d2:2e:81:76:80:e0:98:30

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
System.Text.Encoding.CodePages.dll
.dll windows:4 windows x64 arch:x64

Code Sign

33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11-02-2021 20:09

Not After

10-02-2022 20:09

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cf:84:5d:26:24:89:d7:06:21:45:93:dc:6d:6b:b2:22:5e:ba:c1:c0:f3:dd:d3:30:1a:36:9c:a3:e2:c8:43:b7
Signer

Actual PE Digest

cf:84:5d:26:24:89:d7:06:21:45:93:dc:6d:6b:b2:22:5e:ba:c1:c0:f3:dd:d3:30:1a:36:9c:a3:e2:c8:43:b7

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

System.Text.Encoding.CodePages.ni.pdb
D:\a\_work\1\s\artifacts\obj\System.Text.Encoding.CodePages\net6.0-windows-Release\System.Text.Encoding.CodePages.pdb

Sections

.text
Size: 830KB - Virtual size: 830KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
System.ValueTuple.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:02:13:8c:0c:1c:31:35:bc:d2:5f:00:00:00:00:02:13
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11-02-2021 20:09

Not After

10-02-2022 20:09

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

62:f0:3e:7d:67:d7:db:e7:f0:15:70:7b:d2:90:87:6f:12:dd:6a:0d:61:62:82:9b:9b:d6:67:68:49:3e:a2:00
Signer

Actual PE Digest

62:f0:3e:7d:67:d7:db:e7:f0:15:70:7b:d2:90:87:6f:12:dd:6a:0d:61:62:82:9b:9b:d6:67:68:49:3e:a2:00

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\a\_work\1\s\artifacts\obj\System.ValueTuple\net6.0-Release\System.ValueTuple.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
application-x-firmware-symbolic.svg
audio-speakers-symbolic.symbolic.png
.png
camera-hardware-disabled-symbolic.svg
computer.png
.png
config.model.xml
.xml
dbdump.dll
.dll windows:4 windows x64 arch:x64

7fc7dab0e874d5e47761c7b188160756

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

libsqlite3-0

sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_count
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_text
sqlite3_column_type
sqlite3_errmsg
sqlite3_exec
sqlite3_finalize
sqlite3_free
sqlite3_keyword_check
sqlite3_mprintf
sqlite3_prepare_v2
sqlite3_realloc
sqlite3_realloc64
sqlite3_snprintf
sqlite3_step
sqlite3_strglob
sqlite3_stricmp
sqlite3_table_column_metadata
sqlite3_vmprintf

kernel32

DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
Sleep
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
calloc
free
fwrite
isalnum
isalpha
memcpy
memset
realloc
strcmp
strlen
strncmp
strstr
vfprintf

Exports

Exports

sqlite3_db_dump

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 272B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 77B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 1024B - Virtual size: 807B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/92
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
drive-optical.png
.png
edit-find.png
.png
edit-undo-symbolic-rtl.svg
.xml
emblem-default-symbolic.svg
emblem-important-symbolic.svg
emblem-photos-symbolic.symbolic.png
.png
face-tired-symbolic.symbolic.png
.png
folder-open.png
.png
folder-symbolic.symbolic.png
.png
format-indent-more.png
.png
gmodule-2.0.dll
.dll windows:6 windows x64 arch:x64

7be49518f17af86e5ad757d6dfd9cdeb

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:41

Not After

15-04-2021 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:0e:aa:29:4c:d4:ab:d9:eb:1c:c7:84:c9:24:24:3d
Certificate

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

03-12-2019 00:00

Not After

07-12-2022 12:00

Subject

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

11-02-2011 12:00

Not After

10-02-2026 12:00

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5d:aa:d4:1c:c1:a9:50:0b:5d:ed:a2:79:34:f4:62:3b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

13-08-2018 00:00

Not After

11-09-2021 23:59

Subject

CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

61:19:93:e4:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22-02-2011 19:25

Not After

22-02-2021 19:35

Subject

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

cd:03:c6:34:d9:6c:0f:76:19:54:92:dd:0d:14:c8:c6:c0:38:e7:d8:96:ee:ad:88:f3:85:dd:ff:bb:7b:1f:87
Signer

Actual PE Digest

cd:03:c6:34:d9:6c:0f:76:19:54:92:dd:0d:14:c8:c6:c0:38:e7:d8:96:ee:ad:88:f3:85:dd:ff:bb:7b:1f:87

Digest Algorithm

sha256

PE Digest Matches

true

46:2f:b8:34:54:5d:3c:06:4a:7a:95:e8:bc:39:64:67:2c:a2:35:18
Signer

Actual PE Digest

46:2f:b8:34:54:5d:3c:06:4a:7a:95:e8:bc:39:64:67:2c:a2:35:18

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

d:\build\ob\bora-15653658\cayman_glib\glib\src\build\win32\vs14\Release\x64\bin\gmodule-2.0.pdb

Imports

kernel32

Module32Next
Module32First
GetModuleHandleA
CreateToolhelp32Snapshot
GetLastError
CloseHandle
LoadLibraryW
GetProcAddress
FreeLibrary
SetThreadErrorMode
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

glib-2.0

g_parse_debug_string
g_strdup_printf
g_rec_mutex_lock
g_scanner_input_file
g_private_get
g_file_test
g_scanner_destroy
g_strdup
g_scanner_get_next_token
g_utf8_to_utf16
g_scanner_new
g_strconcat
g_free
g_ascii_strcasecmp
g_rec_mutex_unlock
g_scanner_eof
g_strdup_vprintf
g_return_if_fail_warning
g_open
g_private_replace
g_malloc_n
g_path_get_dirname
g_scanner_scope_add_symbol
g_getenv
g_win32_error_message
g_filename_display_name

vcruntime140

memset
__std_type_info_destroy_list
strrchr
__C_specific_handler

api-ms-win-crt-string-l1-1-0

strncmp

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_cexit
_initialize_onexit_table
_initterm_e
_errno
_initterm

api-ms-win-crt-stdio-l1-1-0

_close

Exports

Exports

g_module_build_path
g_module_close
g_module_error
g_module_make_resident
g_module_name
g_module_name_utf8
g_module_open
g_module_open_utf8
g_module_supported
g_module_symbol

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 708B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
go-first-rtl.png
.png
historya.txt
huskattes.Eks
icon-cli.icns
.html
icona.ico
insert-text-symbolic.symbolic.png
.png
lang-1048.dll
.dll windows:6 windows x86 arch:x86

Code Sign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:fa:99:4d:66:0d:e6:59:ee:90:37:ec:b4:37:d7:66
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

14-10-2019 00:00

Not After

18-10-2022 12:00

Subject

CN=Piriform Software Ltd,OU=RE 901,O=Piriform Software Ltd,L=London,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15-04-2011 19:41

Not After

15-04-2021 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d5:f0:a7:62:a2:44:95:f6:e5:c3:da:46:4e:14:d2:c9:e0:8a:a9:2b:75:33:9b:1b:67:96:b0:41:e1:5c:d1:81
Signer

Actual PE Digest

d5:f0:a7:62:a2:44:95:f6:e5:c3:da:46:4e:14:d2:c9:e0:8a:a9:2b:75:33:9b:1b:67:96:b0:41:e1:5c:d1:81

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 169KB - Virtual size: 168KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
libbrotlicommon.dll
.dll .js windows:4 windows x64 arch:x64 polyglot

ccb34e02e5bd568f952db5cabbf3e2a1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
Sleep
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
calloc
free
fwrite
malloc
realloc
strlen
strncmp
vfprintf

Exports

Exports

BrotliDefaultAllocFunc
BrotliDefaultFreeFunc
BrotliGetDictionary
BrotliGetTransforms
BrotliSetDictionaryData
BrotliTransformDictionaryWord
_kBrotliContextLookupTable
_kBrotliPrefixCodeRanges

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 125KB - Virtual size: 124KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 1024B - Virtual size: 528B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 272B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 512B - Virtual size: 331B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 900B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libidn2-0.dll
.dll windows:4 windows x64 arch:x64

d5398a8e48f555623b64fa51c3a63ef3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateFileA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FindClose
FindFirstFileA
GetCurrentProcess
GetFileInformationByHandle
GetFileType
GetHandleInformation
GetLastError
GetProcAddress
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
MultiByteToWideChar
PeekNamedPipe
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte

msvcrt

___lc_codepage_func
___mb_cur_max_func
__argv
__iob_func
_amsg_exit
_close
_dup2
_errno
_fileno
_get_osfhandle
_getmaxstdio
_initterm
_lock
_open
_open_osfhandle
_setmaxstdio
_setmode
_stricmp
_strdup
_unlock
abort
bsearch
calloc
exit
fflush
fputc
free
fwrite
getc
localeconv
malloc
memcmp
memcpy
memmove
memset
putc
realloc
strchr
strcmp
strerror
strlen
strncmp
strrchr
vfprintf
wcslen

libiconv-2

locale_charset

libintl-8

__printf__
libintl_fprintf
libintl_gettext
libintl_vfprintf

libunistring-2

UC_CATEGORY_M
u32_cmp
u32_cpy
u32_cpy_alloc
u32_normalize
u32_strlen
u32_to_u8
u8_strconv_from_encoding
u8_strconv_to_encoding
u8_strlen
u8_to_u32
uc_bidi_category
uc_combining_class
uc_is_general_category
uc_joining_type
uc_script
uninorm_nfc

Exports

Exports

idn2_check_version
idn2_free
idn2_lookup_u8
idn2_lookup_ul
idn2_register_u8
idn2_register_ul
idn2_strerror
idn2_strerror_name
idn2_to_ascii_4i
idn2_to_ascii_4i2
idn2_to_ascii_4z
idn2_to_ascii_8z
idn2_to_ascii_lz
idn2_to_unicode_44i
idn2_to_unicode_4z4z
idn2_to_unicode_8z4z
idn2_to_unicode_8z8z
idn2_to_unicode_8zlz
idn2_to_unicode_lzlz

Sections

.text
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 192B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 1024B - Virtual size: 581B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
libpangoft2-1.0-0.dll
.dll windows:4 windows x64 arch:x64

e2b5ce9af9db7862bd8d7d2956b0eda4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetLastError
InitializeCriticalSection
LeaveCriticalSection
Sleep
TlsGetValue
VirtualProtect
VirtualQuery

msvcrt

__iob_func
_amsg_exit
_initterm
_lock
_unlock
abort
calloc
free
fwrite
malloc
memcpy
qsort
realloc
strchr
strcmp
strlen
strncmp
vfprintf

libfontconfig-1

FcCharSetAddChar
FcCharSetCopy
FcCharSetDelChar
FcCharSetDestroy
FcCharSetHasChar
FcConfigDestroy
FcConfigGetFonts
FcConfigReference
FcConfigSubstitute
FcDefaultSubstitute
FcFontMatch
FcFontRenderPrepare
FcFontSetAdd
FcFontSetCreate
FcFontSetDestroy
FcFontSetList
FcFontSetMatch
FcFontSetSort
FcInit
FcLangSetGetLangs
FcMatrixMultiply
FcObjectSetAdd
FcObjectSetBuild
FcObjectSetCreate
FcObjectSetDestroy
FcPatternAddDouble
FcPatternAddMatrix
FcPatternAddString
FcPatternBuild
FcPatternCreate
FcPatternDel
FcPatternDestroy
FcPatternDuplicate
FcPatternEqual
FcPatternGet
FcPatternGetBool
FcPatternGetCharSet
FcPatternGetDouble
FcPatternGetInteger
FcPatternGetLangSet
FcPatternGetMatrix
FcPatternGetString
FcPatternHash
FcPatternReference
FcStrListCreate
FcStrListDone
FcStrListFirst
FcStrListNext
FcStrSetDestroy
FcWeightFromOpenTypeDouble
FcWeightToOpenTypeDouble

libfreetype-6

FT_Done_Face
FT_Done_FreeType
FT_Get_Kerning
FT_Init_FreeType
FT_Load_Glyph
FT_New_Face
FT_Render_Glyph
FT_Set_Char_Size
FT_Set_Transform

libgio-2.0-0

g_list_model_get_type
g_list_model_items_changed

libglib-2.0-0

g_array_append_vals
g_array_free
g_array_new
g_array_sort
g_ascii_strcasecmp
g_assertion_message_expr
g_atomic_rc_box_acquire
g_atomic_rc_box_alloc0
g_atomic_rc_box_release_full
g_cond_broadcast
g_cond_clear
g_cond_init
g_cond_signal
g_cond_wait
g_free
g_get_prgname
g_hash_table_destroy
g_hash_table_foreach
g_hash_table_foreach_remove
g_hash_table_insert
g_hash_table_lookup
g_hash_table_new
g_hash_table_new_full
g_hash_table_remove
g_intern_static_string
g_list_prepend
g_list_remove_link
g_log_structured_standard
g_malloc
g_malloc0_n
g_malloc_n
g_memdup2
g_mutex_clear
g_mutex_init
g_mutex_lock
g_mutex_unlock
g_once_init_enter
g_once_init_leave
g_ptr_array_add
g_ptr_array_free
g_ptr_array_new
g_queue_free
g_queue_new
g_queue_pop_tail
g_queue_push_head_link
g_realloc_n
g_return_if_fail_warning
g_slice_alloc
g_slice_free1
g_slist_append
g_slist_delete_link
g_slist_foreach
g_slist_free
g_slist_prepend
g_str_equal
g_str_has_suffix
g_str_hash
g_strdup
g_strfreev
g_strsplit
g_thread_new
g_thread_unref
g_unichar_iswide
g_unichar_iszerowidth
g_unicode_script_from_iso15924
g_unicode_script_to_iso15924
g_utf8_get_char
g_utf8_skip

libgobject-2.0-0

g_boxed_type_register_static
g_enum_get_value
g_enum_get_value_by_nick
g_object_class_install_property
g_object_new
g_object_ref
g_object_set
g_object_unref
g_param_spec_object
g_param_spec_pointer
g_type_add_instance_private
g_type_add_interface_static
g_type_check_class_cast
g_type_check_instance_cast
g_type_check_instance_is_a
g_type_class_adjust_private_offset
g_type_class_peek_parent
g_type_class_ref
g_type_name
g_type_register_static_simple
g_value_get_object
g_value_get_pointer
g_value_set_pointer
g_value_take_object
g_weak_ref_clear
g_weak_ref_get
g_weak_ref_set

libharfbuzz-0

hb_blob_create_from_file
hb_blob_destroy
hb_buffer_add
hb_buffer_create
hb_buffer_destroy
hb_buffer_get_direction
hb_buffer_get_glyph_infos
hb_buffer_get_glyph_positions
hb_buffer_get_length
hb_buffer_reference
hb_buffer_reset
hb_buffer_reverse
hb_buffer_set_direction
hb_face_create
hb_face_destroy
hb_feature_from_string
hb_font_create
hb_font_get_extents_for_direction
hb_font_get_glyph_advance_for_direction
hb_font_get_glyph_extents
hb_font_get_nominal_glyph
hb_font_set_scale
hb_font_set_var_coords_design
hb_ft_face_create
hb_language_from_string
hb_language_to_string
hb_ot_layout_language_find_feature
hb_ot_layout_language_get_feature_tags
hb_ot_layout_language_get_required_feature_index
hb_ot_layout_script_get_language_tags
hb_ot_layout_script_select_language
hb_ot_layout_table_find_script
hb_ot_layout_table_get_script_tags
hb_ot_metrics_get_position
hb_ot_tag_to_language
hb_ot_tag_to_script
hb_ot_tags_from_script_and_language
hb_ot_var_get_axis_infos
hb_ot_var_named_instance_get_design_coords
hb_variation_from_string

libpango-1.0-0

pango_context_get_font_map
pango_context_get_language
pango_context_get_matrix
pango_context_set_language
pango_coverage_get
pango_coverage_get_type
pango_coverage_new
pango_coverage_ref
pango_coverage_unref
pango_font_describe_with_absolute_size
pango_font_description_copy
pango_font_description_copy_static
pango_font_description_equal
pango_font_description_free
pango_font_description_get_family
pango_font_description_get_gravity
pango_font_description_get_size
pango_font_description_get_size_is_absolute
pango_font_description_get_stretch
pango_font_description_get_style
pango_font_description_get_variations
pango_font_description_get_weight
pango_font_description_hash
pango_font_description_new
pango_font_description_set_absolute_size
pango_font_description_set_family
pango_font_description_set_gravity
pango_font_description_set_size
pango_font_description_set_stretch
pango_font_description_set_style
pango_font_description_set_variant
pango_font_description_set_variations
pango_font_description_set_weight
pango_font_description_to_string
pango_font_description_unset_fields
pango_font_face_get_face_name
pango_font_face_get_type
pango_font_family_get_face
pango_font_family_get_name
pango_font_family_get_type
pango_font_get_coverage
pango_font_get_hb_font
pango_font_get_metrics
pango_font_get_type
pango_font_map_changed
pango_font_map_create_context
pango_font_map_get_family
pango_font_map_get_type
pango_font_map_load_fontset
pango_font_metrics_new
pango_font_metrics_ref
pango_font_metrics_unref
pango_fontset_foreach
pango_fontset_get_type
pango_glyph_string_set_size
pango_gravity_get_type
pango_language_from_string
pango_language_get_sample_string
pango_layout_get_context
pango_layout_get_extents
pango_layout_get_lines_readonly
pango_layout_get_type
pango_layout_new
pango_layout_set_font_description
pango_layout_set_text
pango_matrix_get_font_scale_factor
pango_matrix_get_font_scale_factors
pango_renderer_draw_glyphs
pango_renderer_draw_layout
pango_renderer_draw_layout_line
pango_renderer_get_type
pango_renderer_set_matrix
pango_version

Exports

Exports

pango_fc_decoder_get_charset
pango_fc_decoder_get_glyph
pango_fc_decoder_get_type
pango_fc_font_create_base_metrics_for_context
pango_fc_font_description_from_pattern
pango_fc_font_get_glyph
pango_fc_font_get_languages
pango_fc_font_get_pattern
pango_fc_font_get_raw_extents
pango_fc_font_get_type
pango_fc_font_get_unknown_glyph
pango_fc_font_has_char
pango_fc_font_kern_glyphs
pango_fc_font_key_get_context_key
pango_fc_font_key_get_matrix
pango_fc_font_key_get_pattern
pango_fc_font_key_get_variations
pango_fc_font_lock_face
pango_fc_font_map_add_decoder_find_func
pango_fc_font_map_cache_clear
pango_fc_font_map_config_changed
pango_fc_font_map_create_context
pango_fc_font_map_find_decoder
pango_fc_font_map_get_config
pango_fc_font_map_get_hb_face
pango_fc_font_map_get_type
pango_fc_font_map_set_config
pango_fc_font_map_set_default_substitute
pango_fc_font_map_shutdown
pango_fc_font_map_substitute_changed
pango_fc_font_unlock_face
pango_fc_fontset_key_get_absolute_size
pango_fc_fontset_key_get_context_key
pango_fc_fontset_key_get_description
pango_fc_fontset_key_get_language
pango_fc_fontset_key_get_matrix
pango_fc_fontset_key_get_resolution
pango_ft2_font_get_coverage
pango_ft2_font_get_face
pango_ft2_font_get_kerning
pango_ft2_font_get_type
pango_ft2_font_map_create_context
pango_ft2_font_map_for_display
pango_ft2_font_map_get_type
pango_ft2_font_map_new
pango_ft2_font_map_set_default_substitute
pango_ft2_font_map_set_resolution
pango_ft2_font_map_substitute_changed
pango_ft2_get_context
pango_ft2_get_unknown_glyph
pango_ft2_render
pango_ft2_render_layout
pango_ft2_render_layout_line
pango_ft2_render_layout_line_subpixel
pango_ft2_render_layout_subpixel
pango_ft2_render_transformed
pango_ft2_renderer_get_type
pango_ft2_shutdown_display
pango_ot_buffer_add_glyph
pango_ot_buffer_clear
pango_ot_buffer_destroy
pango_ot_buffer_get_glyphs
pango_ot_buffer_get_type
pango_ot_buffer_new
pango_ot_buffer_output
pango_ot_buffer_set_rtl
pango_ot_buffer_set_zero_width_marks
pango_ot_info_find_feature
pango_ot_info_find_language
pango_ot_info_find_script
pango_ot_info_get
pango_ot_info_get_type
pango_ot_info_list_features
pango_ot_info_list_languages
pango_ot_info_list_scripts
pango_ot_ruleset_add_feature
pango_ot_ruleset_description_copy
pango_ot_ruleset_description_equal
pango_ot_ruleset_description_free
pango_ot_ruleset_description_get_type
pango_ot_ruleset_description_hash
pango_ot_ruleset_get_feature_count
pango_ot_ruleset_get_for_description
pango_ot_ruleset_get_type
pango_ot_ruleset_maybe_add_feature
pango_ot_ruleset_maybe_add_features
pango_ot_ruleset_new
pango_ot_ruleset_new_for
pango_ot_ruleset_new_from_description
pango_ot_ruleset_position
pango_ot_ruleset_substitute
pango_ot_tag_from_language
pango_ot_tag_from_script
pango_ot_tag_to_language
pango_ot_tag_to_script

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 112B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 656B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 896B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
mail-mark-important-symbolic.symbolic.png
.png
media-optical-symbolic.symbolic.png
.png
msado25.tlb
.dll windows:10 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
network-no-route-symbolic.svg
network-wireless-encrypted.png
.png
nsis.nsi
osclientcerts.dll
.dll windows:6 windows x64 arch:x64

6549ea5d3c631aad7568de7c5e388e1d

Code Sign

0c:e7:e0:e5:17:d8:46:fe:8f:e5:60:fc:1b:f0:30:39
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10-11-2006 00:00

Not After

10-11-2031 00:00

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22-10-2013 12:00

Not After

22-10-2028 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:1c:d3:ee:a4:7e:dd:a7:a0:32:57:3b:01:4d:0a:fd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

09-04-2021 00:00

Not After

19-06-2024 23:59

Subject

CN=Mozilla Corporation,OU=Firefox Engineering Operations,O=Mozilla Corporation,L=Mountain View,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-01-2021 00:00

Not After

06-01-2031 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

a7:6b:52:3f:e9:82:5e:cb:9d:e2:f6:ad:9d:04:ee:e2:be:ef:4b:40
Signer

Actual PE Digest

a7:6b:52:3f:e9:82:5e:cb:9d:e2:f6:ad:9d:04:ee:e2:be:ef:4b:40

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

osclientcerts.pdb

Imports

kernel32

AcquireSRWLockExclusive
AcquireSRWLockShared
CloseHandle
CreateMutexA
CreateThread
DisableThreadLibraryCalls
EnterCriticalSection
FormatMessageW
GetConsoleMode
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableW
GetLastError
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessHeap
GetStdHandle
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
InitializeCriticalSection
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
SetThreadStackGuarantee
SetUnhandledExceptionFilter
SwitchToThread
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
WaitForSingleObject
WaitForSingleObjectEx
WriteConsoleW
WriteFile

crypt32

CertCloseStore
CertDuplicateCertificateContext
CertFindChainInStore
CertFreeCertificateContext
CertNameToStrA
CertOpenStore
CryptAcquireCertificatePrivateKey

advapi32

CryptCreateHash
CryptDestroyHash
CryptReleaseContext
CryptSetHashParam
CryptSignHashW

ncrypt

BCryptGenRandom
NCryptFreeObject
NCryptSignHash

vcruntime140

__C_specific_handler
__CxxFrameHandler3
__std_type_info_destroy_list
memcmp
memcpy
memmove
memset

api-ms-win-crt-runtime-l1-1-0

_cexit
_configure_narrow_argv
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_seh_filter_dll

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-math-l1-1-0

cbrt

Exports

Exports

C_GetFunctionList

Sections

.text
Size: 277KB - Virtual size: 276KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 185B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
preferences-desktop-peripherals.png
.png
preferences-desktop-screensaver-symbolic.symbolic.png
.png
preferences-system-parental-controls-symbolic.symbolic.png
.png
printer-network-symbolic.symbolic.png
.png
remember.c
ro.txt
sidebar-show-symbolic.symbolic.png
.png
sk.txt
system-file-manager-symbolic.symbolic.png
.png
tp2p100x.sys
.html
uGenUDF.dll
.dll windows:5 windows x86 arch:x86

56d1885a9e829fe9269601d6673efae3

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

4d:7a:5e:95:c9:2e:17:b8:e5:b3:1a:2b:d0:45:3a:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14-04-2015 00:00

Not After

13-07-2018 23:59

Subject

CN=Nero AG,O=Nero AG,L=Karlsruhe,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

4d:7a:5e:95:c9:2e:17:b8:e5:b3:1a:2b:d0:45:3a:49
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14-04-2015 00:00

Not After

13-07-2018 23:59

Subject

CN=Nero AG,O=Nero AG,L=Karlsruhe,ST=Baden Wuerttemberg,C=DE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10-12-2013 00:00

Not After

09-12-2023 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12-01-2016 00:00

Not After

11-01-2031 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

54:f3:7d:a1:71:67:51:bc:6a:8d:0a:d2:74:b2:8b:13
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

12-01-2016 00:00

Not After

11-04-2027 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G1,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

17:bc:82:7d:94:08:46:af:ba:e3:82:28:ee:53:c5:ed:90:d1:11:a4:1a:9d:69:4e:8d:16:33:93:1f:52:86:8c
Signer

Actual PE Digest

17:bc:82:7d:94:08:46:af:ba:e3:82:28:ee:53:c5:ed:90:d1:11:a4:1a:9d:69:4e:8d:16:33:93:1f:52:86:8c

Digest Algorithm

sha256

PE Digest Matches

true

51:2d:62:f5:96:f0:f6:c7:46:8d:eb:28:6f:14:ad:39:27:25:72:ce
Signer

Actual PE Digest

51:2d:62:f5:96:f0:f6:c7:46:8d:eb:28:6f:14:ad:39:27:25:72:ce

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Builds\78\N2\HO_NBR_g_2016_r_2016\Sources\Nero\bin\Release\uGenUDF.pdb

Imports

kernel32

MultiByteToWideChar
WideCharToMultiByte
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
WaitForSingleObject
CloseHandle
GetLastError
GetCurrentThreadId
ReleaseSemaphore
CreateSemaphoreW
FormatMessageW
SystemTimeToFileTime
FileTimeToLocalFileTime
LocalFileTimeToFileTime
FileTimeToSystemTime
GetTickCount
GetShortPathNameW
GetDriveTypeW
GetTempPathW
GetDiskFreeSpaceExW
GetFullPathNameW
SetFileAttributesW
GetFileAttributesW
GetVolumeInformationW
SetLastError
GetFileSize
WriteFile
ReadFile
SetEndOfFile
SetFilePointer
CreateFileW
DeleteFileW
GetSystemInfo
GetDiskFreeSpaceW
FindClose
SetCurrentDirectoryW
GetCurrentDirectoryW
FindFirstFileW
FindNextFileW
GetVersion
GlobalMemoryStatus
LocalFree
Sleep
GetSystemDefaultLangID
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
DisableThreadLibraryCalls

shell32

SHGetMalloc
SHGetSpecialFolderLocation
SHGetPathFromIDListW

uneroerr

?GetNeroErrorList@@YAAAVCNeroErrorList@@K@Z
?WaitForThreadEnd@WorkerThread@@QAEKKPAUHWND__@@@Z
?StartThread@WorkerThread@@UAEHK@Z
??1WorkerThread@@UAE@XZ
??0WorkerThread@@QAE@PAX@Z
?Convert2kToMode2Form1With2336@@YAHQBEQAEPBE@Z
?GetText@CNeroError@@SAHPB_W0PA_WHH@Z
?GenEDC@@YAHPAEKPAV?$LittleEndian@K@@@Z
?CreateNeroErrorList@@YAPAVCNeroErrorList@@XZ
?ERRMyList@@YAAAVCNeroErrorList@@XZ
??1CErrorClone@@UAE@XZ
??0CErrorClone@@QAE@XZ
?GetErrorIcon@CNeroError@@UBE?AW4NeroErrorID@@XZ
?RegisterWorkerThread@@YAXPAVWorkerThread@@@Z
?ERRAdd@@YAABVINeroError@@ABV1@@Z
??0CNeroError@@IAE@PB_WHH@Z
?GetRolledBack@CNeroError@@UBEHXZ
?SetRolledBack@CNeroError@@UAEXH@Z
?GetThreadName@CNeroError@@UBEPB_WXZ
?IsMessageTranslationEnabled@CNeroError@@UBEHXZ
?EnableMessageTranslation@CNeroError@@UAEXH@Z
?GetLine@CNeroError@@UBEHXZ
?GetErrorFile@CNeroError@@UBEPB_WXZ
?GetError@CNeroError@@UBEHXZ
?GetTime@CNeroError@@UBE_JXZ
?GetDescriptionLine@CNeroError@@UBEHHHPA_WH@Z
?GetDescriptionLine@CNeroError@@UBEHHPA_WH@Z
??1CNeroError@@UAE@XZ
?UnRegisterWorkerThread@@YAXPAVWorkerThread@@@Z
?Fatal@CNeroError@@UBEHXZ
?GetDescriptionLine@CNeroError@@UBEHHHPA_WH_N@Z
?SetFatal@CNeroError@@UAEHH@Z

msvcp110

?pbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?_Winerror_map@std@@YAPBDH@Z
??0id@locale@std@@QAE@I@Z
?_BADOFF@std@@3_JB
?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z
?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z
?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ
?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ
?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z
?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z
?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?_Add_vtordisp1@?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAEXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV01@H@Z
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ
?_Add_vtordisp2@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAEXXZ
??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ
??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z
??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ
?rdbuf@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_streambuf@_WU?$char_traits@_W@std@@@2@XZ
?tie@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QBEPAV?$basic_ostream@_WU?$char_traits@_W@std@@@2@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z
??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ
?gbump@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEXH@Z
?pptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?gptr@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IBEPA_WXZ
?_Orphan_all@_Container_base0@std@@QAEXXZ
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
??0_Container_base12@std@@QAE@XZ
??1_Container_base12@std@@QAE@XZ
?_Orphan_all@_Container_base12@std@@QAEXXZ
?uncaught_exception@std@@YA_NXZ
?_Syserror_map@std@@YAPBDH@Z
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ
??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z

msvcr110

wcscspn
wcsncmp
_wrmdir
_errno
_vsnwprintf_s
_wmktemp_s
wcscmp
_wcslwr_s
_wcsupr_s
_getmbcp
??1type_info@@UAE@XZ
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
__CppXcptFilter
_amsg_exit
_malloc_crt
_initterm
_initterm_e
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
?terminate@@YAXXZ
_except_handler4_common
__clean_type_info_names_internal
_wtempnam
_purecall
??2@YAPAXI@Z
??3@YAXPAX@Z
memmove
memcpy
memset
strlen
strncmp
??_V@YAXPAX@Z
_CxxThrowException
__CxxFrameHandler3
wcslen
memcpy_s
strcpy
free
_snwprintf
_wcsdup
wcschr
wcscpy
wcsncpy_s
strncpy_s
malloc
calloc
vswprintf_s
wcscpy_s
wcsrchr
_wcsicmp
swprintf_s
memcmp
realloc
iswascii
_snprintf_s
isalnum
toupper
strftime
_swprintf
_gmtime64_s
_localtime64_s
_mktime64
_time64
_wgetcwd
_wchdir

Exports

Exports

OpenGenerator

Sections

.text
Size: 231KB - Virtual size: 231KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 787KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
vmusbmouse.sys
.html
xfixes-4.0.typelib
.html
zoom-in.png
.png

Sharing

General

Malware Config

Signatures

Files

Password: infected

61259b55b8912888e90f516ca08dc514

Code Sign

64:96:8c:d9:a4:2a:e7:60Certificate

aa:93:02:37:45:a9:52:9e:fa:18:52:7c:59:c1:77:6d:c0:e5:1d:f0Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 128KB

.ndata Size: - Virtual size: 260KB

.rsrc Size: 94KB - Virtual size: 94KB

82274a6f12e4098899c6a675f5ce59d0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 47KB - Virtual size: 46KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 12KB - Virtual size: 52KB

.reloc Size: 3KB - Virtual size: 2KB

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 1024B - Virtual size: 867B

.data Size: 512B - Virtual size: 120B

.reloc Size: 1024B - Virtual size: 662B

ab8abcc1f30df0aad1e517f3b4de4618

Code Sign

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6aCertificate

Key Usages

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0fCertificate

Extended Key Usages

Key Usages

32:b5:c7:f8:c1:8a:7a:2b:fb:b5:27:46Certificate

Extended Key Usages

Key Usages

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

79:62:5a:c1:68:27:c5:a9:48:1c:6a:05:20:39:4b:ac:9b:92:1f:12:0b:9c:72:61:46:e9:09:44:33:d7:e5:bbSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

64:96:8c:d9:a4:2a:e7:60
Certificate

aa:93:02:37:45:a9:52:9e:fa:18:52:7c:59:c1:77:6d:c0:e5:1d:f0
Signer

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 128KB

.ndata
Size: - Virtual size: 260KB

.rsrc
Size: 94KB - Virtual size: 94KB

.text
Size: 47KB - Virtual size: 46KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 12KB - Virtual size: 52KB

.reloc
Size: 3KB - Virtual size: 2KB

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 1024B - Virtual size: 867B

.data
Size: 512B - Virtual size: 120B

.reloc
Size: 1024B - Virtual size: 662B

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

32:b5:c7:f8:c1:8a:7a:2b:fb:b5:27:46
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

79:62:5a:c1:68:27:c5:a9:48:1c:6a:05:20:39:4b:ac:9b:92:1f:12:0b:9c:72:61:46:e9:09:44:33:d7:e5:bb
Signer

.text
Size: 259KB - Virtual size: 258KB

.rdata
Size: 75KB - Virtual size: 74KB

.data
Size: 4KB - Virtual size: 17KB

.pdata
Size: 12KB - Virtual size: 12KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 828B

01:ee:5f:16:9d:ff:97:35:2b:64:65:d6:6a
Certificate

48:1b:6a:07:a9:42:4c:1e:aa:fe:f3:cd:f1:0f
Certificate

32:b5:c7:f8:c1:8a:7a:2b:fb:b5:27:46
Certificate

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

79:62:5a:c1:68:27:c5:a9:48:1c:6a:05:20:39:4b:ac:9b:92:1f:12:0b:9c:72:61:46:e9:09:44:33:d7:e5:bb
Signer