Extracted

• SamsungCommisonforgbz.rar

  .rar
• real shit/Accessibility.dll

  .dll windows:5 windows x86 arch:x86

  
  

  Code Sign

  33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  04-03-2020 18:39

  Not After

  03-03-2021 18:39

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0e:90:d2:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  08-07-2011 20:59

  Not After

  08-07-2026 21:09

  Subject

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  3a:f0:de:d6:1a:65:65:c2:69:3c:f0:3e:7f:36:47:f8:dc:1e:00:b5:33:99:b0:ba:f4:18:1d:9a:9c:f6:1d:f1

  Signer

  Actual PE Digest

  3a:f0:de:d6:1a:65:65:c2:69:3c:f0:3e:7f:36:47:f8:dc:1e:00:b5:33:99:b0:ba:f4:18:1d:9a:9c:f6:1d:f1

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  Accessibility.ni.pdb

  Sections

  .data

  Size: 512B - Virtual size: 4B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .text

  Size: 9KB - Virtual size: 9KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

• real shit/SamsungCommisionExternal.exe

  .exe windows:4 windows x86 arch:x86

  f34d5f2d4577ed6d9ceec516c1f5a744

  
  

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  mscoree

  _CorExeMain

  Sections

  .text

  Size: 61KB - Virtual size: 60KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 512B - Virtual size: 12B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ

• real shit/api-ms-win-core-heap-l1-1-0.dll

  .dll windows:10 windows x86 arch:x86

  
  

  Code Sign

  33:00:00:02:cf:6d:2c:c5:7c:aa:65:a6:d8:00:00:00:00:02:cf

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  02-05-2019 21:25

  Not After

  02-05-2020 21:25

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0c:52:4c:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  06-07-2010 20:40

  Not After

  06-07-2025 20:50

  Subject

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  9d:7e:7e:5a:6f:ea:f9:5d:d2:37:6a:37:96:2b:a2:ee:08:2a:cf:fa:3c:46:36:6d:11:be:5c:33:82:b2:f6:d3

  Signer

  Actual PE Digest

  9d:7e:7e:5a:6f:ea:f9:5d:d2:37:6a:37:96:2b:a2:ee:08:2a:cf:fa:3c:46:36:6d:11:be:5c:33:82:b2:f6:d3

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  api-ms-win-core-heap-l1-1-0.pdb

  Exports

  Exports

  GetProcessHeap

  GetProcessHeaps

  HeapAlloc

  HeapCompact

  HeapCreate

  HeapDestroy

  HeapFree

  HeapLock

  HeapQueryInformation

  HeapReAlloc

  HeapSetInformation

  HeapSize

  HeapSummary

  HeapUnlock

  HeapValidate

  HeapWalk

  Sections

  .text

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1008B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• real shit/api-ms-win-core-interlocked-l1-1-0.dll

  .dll windows:10 windows x86 arch:x86

  
  

  Code Sign

  33:00:00:02:cf:6d:2c:c5:7c:aa:65:a6:d8:00:00:00:00:02:cf

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  02-05-2019 21:25

  Not After

  02-05-2020 21:25

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0c:52:4c:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  06-07-2010 20:40

  Not After

  06-07-2025 20:50

  Subject

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  7e:1e:67:29:c1:5c:a6:dc:99:1d:3f:20:da:d1:df:99:c7:fe:b8:83:eb:47:9d:e3:f4:c6:ff:b9:1d:a0:e2:a8

  Signer

  Actual PE Digest

  7e:1e:67:29:c1:5c:a6:dc:99:1d:3f:20:da:d1:df:99:c7:fe:b8:83:eb:47:9d:e3:f4:c6:ff:b9:1d:a0:e2:a8

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  api-ms-win-core-interlocked-l1-1-0.pdb

  Exports

  Exports

  InitializeSListHead

  InterlockedCompareExchange

  InterlockedCompareExchange64

  InterlockedDecrement

  InterlockedExchange

  InterlockedExchangeAdd

  InterlockedFlushSList

  InterlockedIncrement

  InterlockedPopEntrySList

  InterlockedPushEntrySList

  InterlockedPushListSList

  QueryDepthSList

  Sections

  .text

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1008B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• real shit/api-ms-win-core-libraryloader-l1-1-0.dll

  .dll windows:10 windows x86 arch:x86

  
  

  Code Sign

  33:00:00:02:cf:6d:2c:c5:7c:aa:65:a6:d8:00:00:00:00:02:cf

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  02-05-2019 21:25

  Not After

  02-05-2020 21:25

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0c:52:4c:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  06-07-2010 20:40

  Not After

  06-07-2025 20:50

  Subject

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  4b:c7:d9:3f:8b:ae:31:cf:29:78:b0:cb:ba:11:94:6e:c5:14:0a:07:97:02:8a:64:e8:b1:d1:8c:c3:53:5b:98

  Signer

  Actual PE Digest

  4b:c7:d9:3f:8b:ae:31:cf:29:78:b0:cb:ba:11:94:6e:c5:14:0a:07:97:02:8a:64:e8:b1:d1:8c:c3:53:5b:98

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  api-ms-win-core-libraryloader-l1-1-0.pdb

  Exports

  Exports

  AddDllDirectory

  DisableThreadLibraryCalls

  FindResourceExW

  FindStringOrdinal

  FreeLibrary

  FreeLibraryAndExitThread

  FreeResource

  GetModuleFileNameA

  GetModuleFileNameW

  GetModuleHandleA

  GetModuleHandleExA

  GetModuleHandleExW

  GetModuleHandleW

  GetProcAddress

  LoadLibraryExA

  LoadLibraryExW

  LoadResource

  LoadStringA

  LoadStringW

  LockResource

  RemoveDllDirectory

  SetDefaultDllDirectories

  SizeofResource

  Sections

  .text

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1008B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• real shit/api-ms-win-core-localization-l1-2-0.dll

  .dll windows:10 windows x86 arch:x86

  
  

  Code Sign

  33:00:00:02:cf:6d:2c:c5:7c:aa:65:a6:d8:00:00:00:00:02:cf

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  02-05-2019 21:25

  Not After

  02-05-2020 21:25

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0c:52:4c:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  06-07-2010 20:40

  Not After

  06-07-2025 20:50

  Subject

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  9f:45:ed:68:b7:b9:8d:90:5a:9e:d6:76:fd:a7:91:70:39:26:5b:a8:1b:bf:a0:05:b6:29:07:91:50:02:d9:31

  Signer

  Actual PE Digest

  9f:45:ed:68:b7:b9:8d:90:5a:9e:d6:76:fd:a7:91:70:39:26:5b:a8:1b:bf:a0:05:b6:29:07:91:50:02:d9:31

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  api-ms-win-core-localization-l1-2-0.pdb

  Exports

  Exports

  ConvertDefaultLocale

  EnumSystemGeoID

  EnumSystemLocalesA

  EnumSystemLocalesW

  FindNLSString

  FindNLSStringEx

  FormatMessageA

  FormatMessageW

  GetACP

  GetCPInfo

  GetCPInfoExW

  GetCalendarInfoEx

  GetCalendarInfoW

  GetFileMUIInfo

  GetFileMUIPath

  GetGeoInfoW

  GetLocaleInfoA

  GetLocaleInfoEx

  GetLocaleInfoW

  GetNLSVersion

  GetNLSVersionEx

  GetOEMCP

  GetProcessPreferredUILanguages

  GetSystemDefaultLCID

  GetSystemDefaultLangID

  GetSystemPreferredUILanguages

  GetThreadLocale

  GetThreadPreferredUILanguages

  GetThreadUILanguage

  GetUILanguageInfo

  GetUserDefaultLCID

  GetUserDefaultLangID

  GetUserDefaultLocaleName

  GetUserGeoID

  GetUserPreferredUILanguages

  IdnToAscii

  IdnToUnicode

  IsDBCSLeadByte

  IsDBCSLeadByteEx

  IsNLSDefinedString

  IsValidCodePage

  IsValidLanguageGroup

  IsValidLocale

  IsValidLocaleName

  IsValidNLSVersion

  LCMapStringA

  LCMapStringEx

  LCMapStringW

  LocaleNameToLCID

  ResolveLocaleName

  SetCalendarInfoW

  SetLocaleInfoW

  SetProcessPreferredUILanguages

  SetThreadLocale

  SetThreadPreferredUILanguages

  SetThreadUILanguage

  SetUserGeoID

  VerLanguageNameA

  VerLanguageNameW

  Sections

  .text

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1008B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• real shit/api-ms-win-core-memory-l1-1-0.dll

  .dll windows:10 windows x86 arch:x86

  
  

  Code Sign

  33:00:00:02:cf:6d:2c:c5:7c:aa:65:a6:d8:00:00:00:00:02:cf

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  02-05-2019 21:25

  Not After

  02-05-2020 21:25

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0c:52:4c:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  06-07-2010 20:40

  Not After

  06-07-2025 20:50

  Subject

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  47:7d:f5:15:7a:d6:48:3a:b3:55:47:7b:97:49:f2:bc:e5:52:d2:fa:75:ea:9b:c2:fb:00:68:58:f5:26:b8:d3

  Signer

  Actual PE Digest

  47:7d:f5:15:7a:d6:48:3a:b3:55:47:7b:97:49:f2:bc:e5:52:d2:fa:75:ea:9b:c2:fb:00:68:58:f5:26:b8:d3

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  api-ms-win-core-memory-l1-1-0.pdb

  Exports

  Exports

  CreateFileMappingW

  FlushViewOfFile

  MapViewOfFile

  MapViewOfFileEx

  OpenFileMappingW

  ReadProcessMemory

  UnmapViewOfFile

  VirtualAlloc

  VirtualAllocEx

  VirtualFree

  VirtualFreeEx

  VirtualProtect

  VirtualProtectEx

  VirtualQuery

  VirtualQueryEx

  WriteProcessMemory

  Sections

  .text

  Size: 1KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1008B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• real shit/api-ms-win-core-namedpipe-l1-1-0.dll

  .dll windows:10 windows x86 arch:x86

  
  

  Code Sign

  33:00:00:02:cf:6d:2c:c5:7c:aa:65:a6:d8:00:00:00:00:02:cf

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  02-05-2019 21:25

  Not After

  02-05-2020 21:25

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0c:52:4c:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  06-07-2010 20:40

  Not After

  06-07-2025 20:50

  Subject

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  a9:c7:62:b2:1d:90:3b:09:7b:11:77:b5:0d:ac:92:2f:80:c6:8f:df:08:80:4c:f3:a7:88:34:4c:c3:81:11:5e

  Signer

  Actual PE Digest

  a9:c7:62:b2:1d:90:3b:09:7b:11:77:b5:0d:ac:92:2f:80:c6:8f:df:08:80:4c:f3:a7:88:34:4c:c3:81:11:5e

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  api-ms-win-core-namedpipe-l1-1-0.pdb

  Exports

  Exports

  ConnectNamedPipe

  CreateNamedPipeW

  CreatePipe

  DisconnectNamedPipe

  GetNamedPipeClientComputerNameW

  ImpersonateNamedPipeClient

  PeekNamedPipe

  SetNamedPipeHandleState

  TransactNamedPipe

  WaitNamedPipeW

  Sections

  .text

  Size: 1024B - Virtual size: 949B

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1008B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• real shit/api-ms-win-core-processenvironment-l1-1-0.dll

  .dll windows:10 windows x86 arch:x86

  
  

  Code Sign

  33:00:00:02:cf:6d:2c:c5:7c:aa:65:a6:d8:00:00:00:00:02:cf

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  02-05-2019 21:25

  Not After

  02-05-2020 21:25

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0c:52:4c:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  06-07-2010 20:40

  Not After

  06-07-2025 20:50

  Subject

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  57:f7:5b:2a:be:aa:49:76:53:cb:d1:fe:ae:c2:55:65:81:3a:f7:4e:1c:dd:da:92:83:12:b4:c8:7d:9c:3a:3b

  Signer

  Actual PE Digest

  57:f7:5b:2a:be:aa:49:76:53:cb:d1:fe:ae:c2:55:65:81:3a:f7:4e:1c:dd:da:92:83:12:b4:c8:7d:9c:3a:3b

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  api-ms-win-core-processenvironment-l1-1-0.pdb

  Exports

  Exports

  ExpandEnvironmentStringsA

  ExpandEnvironmentStringsW

  FreeEnvironmentStringsA

  FreeEnvironmentStringsW

  GetCommandLineA

  GetCommandLineW

  GetCurrentDirectoryA

  GetCurrentDirectoryW

  GetEnvironmentStrings

  GetEnvironmentStringsW

  GetEnvironmentVariableA

  GetEnvironmentVariableW

  GetStdHandle

  SearchPathW

  SetCurrentDirectoryA

  SetCurrentDirectoryW

  SetEnvironmentStringsW

  SetEnvironmentVariableA

  SetEnvironmentVariableW

  SetStdHandle

  SetStdHandleEx

  Sections

  .text

  Size: 2KB - Virtual size: 1KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1008B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

• real shit/api-ms-win-core-processthreads-l1-1-0.dll

  .dll windows:10 windows x86 arch:x86

  
  

  Code Sign

  33:00:00:02:cf:6d:2c:c5:7c:aa:65:a6:d8:00:00:00:00:02:cf

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  02-05-2019 21:25

  Not After

  02-05-2020 21:25

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0c:52:4c:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  06-07-2010 20:40

  Not After

  06-07-2025 20:50

  Subject

  CN=Microsoft Code Signing PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  e9:79:9a:ed:f0:7f:45:a0:c8:d5:d8:72:bc:17:e9:48:66:79:56:dc:40:31:89:d4:fe:67:86:0b:9a:5b:1f:25

  Signer

  Actual PE Digest

  e9:79:9a:ed:f0:7f:45:a0:c8:d5:d8:72:bc:17:e9:48:66:79:56:dc:40:31:89:d4:fe:67:86:0b:9a:5b:1f:25

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_NO_SEH

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_32BIT_MACHINE

  IMAGE_FILE_DLL

  PDB Paths

  api-ms-win-core-processthreads-l1-1-0.pdb

  Exports

  Exports

  CreateProcessA

  CreateProcessAsUserW

  CreateProcessW

  CreateRemoteThread

  CreateRemoteThreadEx

  CreateThread

  DeleteProcThreadAttributeList

  ExitProcess

  ExitThread

  FlushProcessWriteBuffers

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThread

  GetCurrentThreadId

  GetExitCodeProcess

  GetExitCodeThread

  GetPriorityClass

  GetProcessId

  GetProcessIdOfThread

  GetProcessTimes

  GetProcessVersion

  GetStartupInfoW

  GetThreadId

  GetThreadPriority

  GetThreadPriorityBoost

  InitializeProcThreadAttributeList

  OpenProcessToken

  OpenThread

  OpenThreadToken

  ProcessIdToSessionId

  QueryProcessAffinityUpdateMode

  QueueUserAPC

  ResumeThread

  SetPriorityClass

  SetProcessAffinityUpdateMode

  SetProcessShutdownParameters

  SetThreadPriority

  SetThreadPriorityBoost

  SetThreadStackGuarantee

  SetThreadToken

  SuspendThread

  SwitchToThread

  TerminateProcess

  TerminateThread

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  UpdateProcThreadAttribute

  Sections

  .text

  Size: 3KB - Virtual size: 3KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rsrc

  Size: 1024B - Virtual size: 1008B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ