blankgrabber | Black Crypt 2022[.]rar

Sharing

Copy URL

Twitter E-mail

General

Target

Black Crypt 2022.rar
Size

12.2MB
MD5

6efc9fcb4a4644a34d53c4879c10f97b
SHA1

0462644ae850d6badf55b6fae392ba650abbbda3
SHA256

c2032894c83b4edcd96e5cdd9afac76c5d2042a8cfbe2673c80b338dc390a6fa
SHA512

7b3c11f6e1e5d459cc049e2277606a3958ad31ed47c9e2df75fd47309c7a460b856ea14466621b763f5d6c5bad253d0cd6abbb66a3a206ac0d45b0f66465a6b4
SSDEEP

393216:voJzQAKrVcEyYaGZDteyCuw4a6KdBjCYTFd9ole:voJznCuTGNteduw4dKdlb9og

Score

10^/10

blankgrabber

Malware Config

Signatures

A stealer written in Python and packaged with Pyinstaller 1 IoCs

resource	yara_rule
static1/unpack003/ 5--��.pyc	blankgrabber

Blankgrabber family
blankgrabber

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack002/Fortnite Cheat/MonoPosixHelper.dll
unpack002/Fortnite Cheat/NBitcoin.dll

Files

Black Crypt 2022.rar
.rar
Fortnite Cheat.zip
.zip
Fortnite Cheat/Fortnite Cheat.exe
.exe windows:6 windows x64 arch:x64

72c4e339b7af8ab1ed2eb3821c98713a

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

25/05/2021, 00:00

Not After

31/12/2028, 23:59

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Not Before

22/03/2021, 00:00

Not After

21/03/2036, 23:59

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3
Certificate

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Not Before

29/09/2021, 00:00

Not After

28/09/2024, 23:59

Subject

SERIALNUMBER=407950,CN=Akeo Consulting,O=Akeo Consulting,ST=Donegal,C=IE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024945

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

94:50:7e:fc:66:32:0f:bc:29:8b:af:c0:eb:82:2f:7c:6b:3c:00:85:86:e1:07:16:2c:00:74:b9:00:5e:49:f7
Signer

Actual PE Digest

94:50:7e:fc:66:32:0f:bc:29:8b:af:c0:eb:82:2f:7c:6b:3c:00:85:86:e1:07:16:2c:00:74:b9:00:5e:49:f7

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

CreateWindowExW
ShutdownBlockReasonCreate
MsgWaitForMultipleObjects
ShowWindow
DestroyWindow
RegisterClassW
DefWindowProcW
PeekMessageW
DispatchMessageW
TranslateMessage
PostMessageW
GetMessageW
MessageBoxW
MessageBoxA
SystemParametersInfoW
DestroyIcon
SetWindowLongPtrW
GetWindowLongPtrW
GetClientRect
InvalidateRect
ReleaseDC
GetDC
DrawTextW
GetDialogBaseUnits
EndDialog
DialogBoxIndirectParamW
MoveWindow
SendMessageW

comctl32

ord380

kernel32

GetACP
IsValidCodePage
GetStringTypeW
GetFileAttributesExW
SetEnvironmentVariableW
FlushFileBuffers
GetCurrentDirectoryW
LCMapStringW
CompareStringW
FlsFree
GetOEMCP
GetCPInfo
GetModuleHandleW
MulDiv
FormatMessageW
GetLastError
GetModuleFileNameW
LoadLibraryExW
SetDllDirectoryW
CreateSymbolicLinkW
GetProcAddress
GetEnvironmentStringsW
GetCommandLineW
GetEnvironmentVariableW
ExpandEnvironmentStringsW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
RemoveDirectoryW
GetTempPathW
CloseHandle
QueryPerformanceCounter
QueryPerformanceFrequency
WaitForSingleObject
Sleep
GetCurrentProcess
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetStartupInfoW
FreeLibrary
LocalFree
SetConsoleCtrlHandler
K32EnumProcessModules
K32GetModuleFileNameExW
CreateFileW
FindFirstFileExW
GetFinalPathNameByHandleW
MultiByteToWideChar
WideCharToMultiByte
FlsSetValue
FreeEnvironmentStringsW
GetProcessHeap
GetTimeZoneInformation
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
CreateDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
EncodePointer
RaiseException
RtlPcToFileHeader
GetCommandLineA
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ReadFile
GetFullPathNameW
SetStdHandle
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
HeapFree
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetConsoleOutputCP
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue

advapi32

OpenProcessToken
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW

gdi32

SelectObject
DeleteObject
CreateFontIndirectW

Sections

.text
Size: 168KB - Virtual size: 167KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
5--��.pyc
Fortnite Cheat/Grpc.Core.Api.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

0c:15:be:4a:15:bb:09:03:c9:01:b1:d6:c2:65:30:2f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/11/2018, 00:00

Not After

17/11/2021, 12:00

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=ca,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2d:fb:11:91:fc:4c:85:84:cf:91:a6:99:87:24:a2:5a:d7:00:d3:6b:9b:a2:75:e7:0b:91:a5:70:da:09:72:be
Signer

Actual PE Digest

2d:fb:11:91:fc:4c:85:84:cf:91:a6:99:87:24:a2:5a:d7:00:d3:6b:9b:a2:75:e7:0b:91:a5:70:da:09:72:be

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

T:\src\github\grpc\src\csharp\Grpc.Core.Api\obj\Release\net45\Grpc.Core.Api.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fortnite Cheat/Grpc.Core.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

0c:15:be:4a:15:bb:09:03:c9:01:b1:d6:c2:65:30:2f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/11/2018, 00:00

Not After

17/11/2021, 12:00

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=ca,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a8:7b:53:f2:e0:71:aa:4d:53:42:5d:db:b3:81:d2:ca:92:19:8b:22:8e:82:6b:fe:6c:a0:11:9a:6d:65:a4:6b
Signer

Actual PE Digest

a8:7b:53:f2:e0:71:aa:4d:53:42:5d:db:b3:81:d2:ca:92:19:8b:22:8e:82:6b:fe:6c:a0:11:9a:6d:65:a4:6b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

T:\src\github\grpc\src\csharp\Grpc.Core\obj\Release\net45\Grpc.Core.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 451KB - Virtual size: 451KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 908B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fortnite Cheat/Important.txt
Fortnite Cheat/Microsoft.Extensions.Logging.Abstractions.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

28/10/2015, 20:31

Not After

28/01/2017, 20:31

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e3:71:ab:6d:fc:3b:f5:11:50:0b:77:bf:5e:dc:02:39:7e:10:a4:8b:50:b6:99:19:4c:f2:f0:65:62:5e:13:eb
Signer

Actual PE Digest

e3:71:ab:6d:fc:3b:f5:11:50:0b:77:bf:5e:dc:02:39:7e:10:a4:8b:50:b6:99:19:4c:f2:f0:65:62:5e:13:eb

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\BuildAgent\work\a6e561eeb4ed13a7\Logging\src\Microsoft.Extensions.Logging.Abstractions\bin\Release\netstandard1.1\Microsoft.Extensions.Logging.Abstractions.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fortnite Cheat/MonoPosixHelper.dll
.dll windows:5 windows x64 arch:x64

a5b5455ed073025b53a2563e582a4cdb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\buildslave\mono\build\msvc\x64_Release_eglib\bin\monoposixhelper.pdb

Imports

kernel32

HeapAlloc
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetLastError
HeapReAlloc
HeapFree
GetCurrentThreadId
FlsSetValue
GetCommandLineA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
EncodePointer
FlsGetValue
FlsFree
SetLastError
FlsAlloc
DecodePointer
RtlUnwindEx
SetStdHandle
InitializeCriticalSectionAndSpinCount
GetFileType
WriteFile
WideCharToMultiByte
GetConsoleCP
GetConsoleMode
GetProcAddress
GetModuleHandleW
ExitProcess
GetStdHandle
GetModuleFileNameW
HeapSetInformation
GetVersion
HeapCreate
HeapDestroy
SetFilePointer
SetHandleCount
GetStartupInfoW
DeleteCriticalSection
Sleep
ReadFile
MultiByteToWideChar
LCMapStringW
GetStringTypeW
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
GetACP
GetOEMCP
IsValidCodePage
WriteConsoleW
LoadLibraryW
FlushFileBuffers
CreateFileW
CloseHandle
HeapSize

Exports

Exports

CloseZStream
CreateZStream
Flush
Mono_Posix_FromAccessModes
Mono_Posix_FromConfstrName
Mono_Posix_FromDirectoryNotifyFlags
Mono_Posix_FromErrno
Mono_Posix_FromFcntlCommand
Mono_Posix_FromFilePermissions
Mono_Posix_FromLockType
Mono_Posix_FromLockfCommand
Mono_Posix_FromMlockallFlags
Mono_Posix_FromMmapFlags
Mono_Posix_FromMmapProts
Mono_Posix_FromMountFlags
Mono_Posix_FromMremapFlags
Mono_Posix_FromMsyncFlags
Mono_Posix_FromOpenFlags
Mono_Posix_FromPathconfName
Mono_Posix_FromPollEvents
Mono_Posix_FromPosixFadviseAdvice
Mono_Posix_FromPosixMadviseAdvice
Mono_Posix_FromSeekFlags
Mono_Posix_FromSignum
Mono_Posix_FromSysconfName
Mono_Posix_FromSyslogFacility
Mono_Posix_FromSyslogLevel
Mono_Posix_FromSyslogOptions
Mono_Posix_FromWaitOptions
Mono_Posix_FromXattrFlags
Mono_Posix_Stdlib_BUFSIZ
Mono_Posix_Stdlib_CreateFilePosition
Mono_Posix_Stdlib_DumpFilePosition
Mono_Posix_Stdlib_EOF
Mono_Posix_Stdlib_EXIT_FAILURE
Mono_Posix_Stdlib_EXIT_SUCCESS
Mono_Posix_Stdlib_FILENAME_MAX
Mono_Posix_Stdlib_FOPEN_MAX
Mono_Posix_Stdlib_InvokeSignalHandler
Mono_Posix_Stdlib_L_tmpnam
Mono_Posix_Stdlib_MB_CUR_MAX
Mono_Posix_Stdlib_RAND_MAX
Mono_Posix_Stdlib_SIG_DFL
Mono_Posix_Stdlib_SIG_ERR
Mono_Posix_Stdlib_SIG_IGN
Mono_Posix_Stdlib_SetLastError
Mono_Posix_Stdlib_TMP_MAX
Mono_Posix_Stdlib__IOFBF
Mono_Posix_Stdlib__IOLBF
Mono_Posix_Stdlib__IONBF
Mono_Posix_Stdlib_calloc
Mono_Posix_Stdlib_clearerr
Mono_Posix_Stdlib_fgetpos
Mono_Posix_Stdlib_fread
Mono_Posix_Stdlib_fseek
Mono_Posix_Stdlib_fsetpos
Mono_Posix_Stdlib_ftell
Mono_Posix_Stdlib_fwrite
Mono_Posix_Stdlib_malloc
Mono_Posix_Stdlib_perror
Mono_Posix_Stdlib_realloc
Mono_Posix_Stdlib_rewind
Mono_Posix_Stdlib_setbuf
Mono_Posix_Stdlib_setvbuf
Mono_Posix_Stdlib_stderr
Mono_Posix_Stdlib_stdin
Mono_Posix_Stdlib_stdout
Mono_Posix_Stdlib_strlen
Mono_Posix_ToAccessModes
Mono_Posix_ToConfstrName
Mono_Posix_ToDirectoryNotifyFlags
Mono_Posix_ToErrno
Mono_Posix_ToFcntlCommand
Mono_Posix_ToFilePermissions
Mono_Posix_ToLockType
Mono_Posix_ToLockfCommand
Mono_Posix_ToMlockallFlags
Mono_Posix_ToMmapFlags
Mono_Posix_ToMmapProts
Mono_Posix_ToMountFlags
Mono_Posix_ToMremapFlags
Mono_Posix_ToMsyncFlags
Mono_Posix_ToOpenFlags
Mono_Posix_ToPathconfName
Mono_Posix_ToPollEvents
Mono_Posix_ToPosixFadviseAdvice
Mono_Posix_ToPosixMadviseAdvice
Mono_Posix_ToSeekFlags
Mono_Posix_ToSignum
Mono_Posix_ToSysconfName
Mono_Posix_ToSyslogFacility
Mono_Posix_ToSyslogLevel
Mono_Posix_ToSyslogOptions
Mono_Posix_ToWaitOptions
Mono_Posix_ToXattrFlags
ReadZStream
WriteZStream

Sections

.text
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 436B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 996B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fortnite Cheat/NBitcoin.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Sources\NBitcoin\NBitcoin\obj\Release\net472\NBitcoin.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1012B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fortnite Cheat/Newtonsoft.Json.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2031, 00:00

Subject

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

27/04/2018, 12:41

Not After

27/04/2028, 12:41

Subject

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Certificate

Issuer

CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US

Not Before

25/10/2018, 00:00

Not After

29/10/2021, 12:00

Subject

SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:10:56:8e:61:ed:4a:db:b2:78:fe:51:cd:63:62:ed:e4:18:e6:f9:b5:44:af:42:d1:80:41:52:2d:66:12:81
Signer

Actual PE Digest

8c:10:56:8e:61:ed:4a:db:b2:78:fe:51:cd:63:62:ed:e4:18:e6:f9:b5:44:af:42:d1:80:41:52:2d:66:12:81

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 673KB - Virtual size: 673KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fortnite Cheat/Readme.txt
Fortnite Cheat/Siticone.UI.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

3a:93:0b:19:8f:29:72:9a:49:b0:8b:f3:6d:f8:17:ae
Certificate

Issuer

CN=Siticone Root CA

Not Before

05/02/2020, 06:42

Not After

22/10/2030, 17:00

Subject

CN=Siticone Technology

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66
Certificate

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2014, 00:00

Not After

22/10/2024, 00:00

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

10/11/2006, 00:00

Not After

10/11/2021, 00:00

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageServerAuth
ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning
ExtKeyUsageEmailProtection
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

34:8f:92:bf:68:07:1b:a4:18:d3:f6:b4:4e:02:5a:2c:51:c0:51:c0
Signer

Actual PE Digest

34:8f:92:bf:68:07:1b:a4:18:d3:f6:b4:4e:02:5a:2c:51:c0:51:c0

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Ilham-PC\Documents\Visual Studio 2015\Projects\Siticone.UI\Build\Release\Siticone.UI.WinForms\Siticone.UI.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Fortnite Cheat/System.Buffers.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:cc:cb:b8:13:eb:5d:72:2d:45:00:00:00:00:00:cc
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=MOPR+OU=nCipher DSE ESN:148C-C4B9-2066,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:40:96:a9:ee:70:56:fe:cc:07:00:01:00:00:01:40
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

18/08/2016, 20:17

Not After

02/11/2017, 20:17

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:8e:87:91:a4:57:1a:5f:ca:3e:00:00:00:00:00:8e
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

17/11/2016, 22:09

Not After

17/02/2018, 22:09

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

b7:fd:c6:4e:3f:0e:c4:6a:46:dc:61:3d:22:32:31:cf:6a:33:a6:e7:2e:9c:36:84:16:6a:68:71:65:28:ba:4d
Signer

Actual PE Digest

b7:fd:c6:4e:3f:0e:c4:6a:46:dc:61:3d:22:32:31:cf:6a:33:a6:e7:2e:9c:36:84:16:6a:68:71:65:28:ba:4d

Digest Algorithm

sha256

PE Digest Matches

true

88:20:b4:f5:f9:76:f7:25:eb:69:ef:08:4d:63:05:1d:06:6a:e5:e8
Signer

Actual PE Digest

88:20:b4:f5:f9:76:f7:25:eb:69:ef:08:4d:63:05:1d:06:6a:e5:e8

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\A\_work\500\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Buffers\netstandard\System.Buffers.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fortnite Cheat/System.ComponentModel.Annotations.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:bf:91:6c:fb:7c:1a:24:e0:22:00:00:00:00:00:bf
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:57C8-2D15-1C8B,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:20

Not After

11/08/2018, 20:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

5f:90:d3:b6:dd:87:df:4e:84:6f:b5:22:f4:f6:9c:c6:e6:fd:34:f3:6b:0a:66:83:1d:4b:6c:06:60:25:a2:05
Signer

Actual PE Digest

5f:90:d3:b6:dd:87:df:4e:84:6f:b5:22:f4:f6:9c:c6:e6:fd:34:f3:6b:0a:66:83:1d:4b:6c:06:60:25:a2:05

Digest Algorithm

sha256

PE Digest Matches

true

c3:31:16:77:dd:f7:23:e7:e9:f0:6b:b3:3c:f4:65:e7:13:97:71:ed
Signer

Actual PE Digest

c3:31:16:77:dd:f7:23:e7:e9:f0:6b:b3:3c:f4:65:e7:13:97:71:ed

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\A\_work\39\s\corefx\bin/obj/AnyOS.AnyCPU.Release/System.ComponentModel.Annotations/netfx\System.ComponentModel.Annotations.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 22KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fortnite Cheat/System.Memory.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:01:07:63:a5:19:2a:11:27:e5:d9:00:00:00:00:01:07
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2018, 20:20

Not After

23/11/2019, 20:20

Subject

CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:AB41-4B27-F026,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:11

Not After

26/07/2019, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:08

Not After

26/07/2019, 20:08

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2b:54:3e:2e:ae:d1:3f:75:44:7c:78:ac:21:d7:b3:89:2d:0b:98:10:d0:71:d0:86:11:49:c3:ce:17:53:54:f2
Signer

Actual PE Digest

2b:54:3e:2e:ae:d1:3f:75:44:7c:78:ac:21:d7:b3:89:2d:0b:98:10:d0:71:d0:86:11:49:c3:ce:17:53:54:f2

Digest Algorithm

sha256

PE Digest Matches

true

b2:6a:dd:6f:2d:d8:f7:e8:df:ee:d9:c8:cb:75:7f:58:cb:0e:0c:b5
Signer

Actual PE Digest

b2:6a:dd:6f:2d:d8:f7:e8:df:ee:d9:c8:cb:75:7f:58:cb:0e:0c:b5

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\A\_work\89\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Memory\netstandard\System.Memory.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 127KB - Virtual size: 126KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fortnite Cheat/System.Runtime.CompilerServices.Unsafe.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:01:0a:83:34:a8:fb:fd:d0:38:76:00:00:00:00:01:0a
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

23/08/2018, 20:20

Not After

23/11/2019, 20:20

Subject

CN=Microsoft Time-Stamp service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:8E9E-4BD0-2ED0,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:b1:dd:ed:ba:54:e9:65:b8:5f:00:01:00:00:01:b1
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:11

Not After

26/07/2019, 20:11

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:01:03:5e:25:1c:99:1f:a3:1e:b8:00:00:00:00:01:03
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

12/07/2018, 20:08

Not After

26/07/2019, 20:08

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a1:86:a4:ae:f3:dd:ce:5d:c3:73:98:b8:87:69:e4:b4:0e:c9:57:60:e0:e7:c3:1a:bc:f8:ed:3e:f9:4b:58:be
Signer

Actual PE Digest

a1:86:a4:ae:f3:dd:ce:5d:c3:73:98:b8:87:69:e4:b4:0e:c9:57:60:e0:e7:c3:1a:bc:f8:ed:3e:f9:4b:58:be

Digest Algorithm

sha256

PE Digest Matches

true

fb:04:b1:54:63:fe:e1:f1:d9:2e:93:23:b7:8a:35:0d:bf:24:35:54
Signer

Actual PE Digest

fb:04:b1:54:63:fe:e1:f1:d9:2e:93:23:b7:8a:35:0d:bf:24:35:54

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fortnite Cheat/System.Security.Cryptography.ProtectedData.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:03:d2:da:19:16:5d:6d:c7:49:af:00:00:00:00:03:d2
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

22/02/2024, 20:25

Not After

19/02/2025, 20:25

Subject

CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2f:7b:a7:b7:89:9e:cc:70:1b:9f:97:a6:6f:a1:3c:95:9e:1f:f0:df:e0:0c:d4:41:e7:6c:e5:8d:3d:2d:ea:1d
Signer

Actual PE Digest

2f:7b:a7:b7:89:9e:cc:70:1b:9f:97:a6:6f:a1:3c:95:9e:1f:f0:df:e0:0c:d4:41:e7:6c:e5:8d:3d:2d:ea:1d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

/_/artifacts/obj/System.Security.Cryptography.ProtectedData/Release/net462/System.Security.Cryptography.ProtectedData.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fortnite Cheat/System.Threading.Tasks.Extensions.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02/05/2019, 21:37

Not After

02/05/2020, 21:37

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

da:fb:83:40:c8:c2:8e:cb:07:b8:6a:f1:de:5f:60:bf:04:02:39:30:51:4d:e3:8a:90:db:7a:5d:d3:4f:71:f0
Signer

Actual PE Digest

da:fb:83:40:c8:c2:8e:cb:07:b8:6a:f1:de:5f:60:bf:04:02:39:30:51:4d:e3:8a:90:db:7a:5d:d3:4f:71:f0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

E:\A\_work\156\s\corefx\bin\obj\AnyOS.AnyCPU.Release\System.Threading.Tasks.Extensions\netfx\System.Threading.Tasks.Extensions.pdb

Imports

mscoree

_CorDllMain

Sections

.text
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fortnite Cheat/cheat.ini
Fortnite Cheat/config.sys
Fortnite Cheat/grpc_csharp_ext.x64.dll
.dll windows:6 windows x64 arch:x64

cbfc275161b4cc22cffb53b42275ddce

Code Sign

0c:15:be:4a:15:bb:09:03:c9:01:b1:d6:c2:65:30:2f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/11/2018, 00:00

Not After

17/11/2021, 12:00

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=ca,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

fb:60:34:e1:a0:06:92:c3:14:da:a8:8c:85:c7:0f:92:1a:f7:c7:ca:34:5d:b6:fc:7f:7f:9f:21:fd:5c:94:ca
Signer

Actual PE Digest

fb:60:34:e1:a0:06:92:c3:14:da:a8:8c:85:c7:0f:92:1a:f7:c7:ca:34:5d:b6:fc:7f:7f:9f:21:fd:5c:94:ca

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

T:\src\github\grpc\workspace_csharp_ext_windows_x64\cmake\build\x64\grpc_csharp_ext.pdb

Imports

wsock32

getservbyport
recvfrom
connect
__WSAFDIsSet
gethostname
ioctlsocket
getsockopt
inet_ntoa
send
recv
WSASetLastError
setsockopt
listen
getsockname
getpeername
WSAGetLastError
socket
closesocket
bind
ntohs
ntohl
htonl
WSACleanup
WSAStartup
htons

ws2_32

WSARecvFrom
WSAConnect
WSASend
WSARecv
freeaddrinfo
getaddrinfo
WSAGetOverlappedResult
WSASocketA
WSAIoctl
inet_pton
inet_ntop

kernel32

FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
GetFullPathNameA
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetStdHandle
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapReAlloc
GetStdHandle
GetACP
GetStringTypeW
GetCurrentThread
CloseHandle
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
GetCurrentThreadId
SetEnvironmentVariableW
WaitForSingleObject
CreateEventA
CreateThread
GetCurrentProcessorNumber
GetSystemInfo
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
InitOnceExecuteOnce
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
LocalFree
FormatMessageA
GetEnvironmentVariableA
SetEnvironmentVariableA
SetLastError
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TlsAlloc
TlsGetValue
TlsSetValue
RtlVirtualUnwind
FreeLibrary
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsA
GetWindowsDirectoryA
GetVersionExA
GetTickCount
GetProcessHeap
WriteConsoleW
HeapSize
SetEndOfFile
OutputDebugStringW
OutputDebugStringA
SetEvent
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
FormatMessageW
WideCharToMultiByte
RtlPcToFileHeader
EncodePointer
RaiseException
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
TlsFree
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
SetFilePointerEx
GetConsoleMode
ReadConsoleW
WriteFile
GetConsoleCP
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
HeapFree
HeapAlloc
SetConsoleCtrlHandler

advapi32

RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
SystemFunction036
RegGetValueA

Exports

Exports

gprsharp_convert_clock_type
gprsharp_free
gprsharp_inf_future
gprsharp_inf_past
gprsharp_now
gprsharp_sizeof_timespec
grpcsharp_auth_context_peer_identity_property_name
grpcsharp_auth_context_property_iterator
grpcsharp_auth_context_release
grpcsharp_auth_property_iterator_next
grpcsharp_batch_context_create
grpcsharp_batch_context_destroy
grpcsharp_batch_context_recv_close_on_server_cancelled
grpcsharp_batch_context_recv_initial_metadata
grpcsharp_batch_context_recv_message_length
grpcsharp_batch_context_recv_message_next_slice_peek
grpcsharp_batch_context_recv_status_on_client_details
grpcsharp_batch_context_recv_status_on_client_status
grpcsharp_batch_context_recv_status_on_client_trailing_metadata
grpcsharp_batch_context_reset
grpcsharp_call_auth_context
grpcsharp_call_cancel
grpcsharp_call_cancel_with_status
grpcsharp_call_credentials_release
grpcsharp_call_destroy
grpcsharp_call_get_peer
grpcsharp_call_recv_initial_metadata
grpcsharp_call_recv_message
grpcsharp_call_send_close_from_client
grpcsharp_call_send_initial_metadata
grpcsharp_call_send_message
grpcsharp_call_send_status_from_server
grpcsharp_call_set_credentials
grpcsharp_call_start_client_streaming
grpcsharp_call_start_duplex_streaming
grpcsharp_call_start_server_streaming
grpcsharp_call_start_serverside
grpcsharp_call_start_unary
grpcsharp_channel_args_create
grpcsharp_channel_args_destroy
grpcsharp_channel_args_set_integer
grpcsharp_channel_args_set_string
grpcsharp_channel_check_connectivity_state
grpcsharp_channel_create_call
grpcsharp_channel_credentials_release
grpcsharp_channel_destroy
grpcsharp_channel_get_target
grpcsharp_channel_watch_connectivity_state
grpcsharp_completion_queue_create_async
grpcsharp_completion_queue_create_sync
grpcsharp_completion_queue_destroy
grpcsharp_completion_queue_next
grpcsharp_completion_queue_pluck
grpcsharp_completion_queue_shutdown
grpcsharp_composite_call_credentials_create
grpcsharp_composite_channel_credentials_create
grpcsharp_init
grpcsharp_insecure_channel_create
grpcsharp_metadata_array_add
grpcsharp_metadata_array_count
grpcsharp_metadata_array_create
grpcsharp_metadata_array_destroy_full
grpcsharp_metadata_array_get_key
grpcsharp_metadata_array_get_value
grpcsharp_metadata_credentials_create_from_plugin
grpcsharp_metadata_credentials_notify_from_plugin
grpcsharp_native_callback_dispatcher_init
grpcsharp_override_default_ssl_roots
grpcsharp_redirect_log
grpcsharp_request_call_context_call
grpcsharp_request_call_context_create
grpcsharp_request_call_context_deadline
grpcsharp_request_call_context_destroy
grpcsharp_request_call_context_host
grpcsharp_request_call_context_method
grpcsharp_request_call_context_request_metadata
grpcsharp_request_call_context_reset
grpcsharp_secure_channel_create
grpcsharp_server_add_insecure_http2_port
grpcsharp_server_add_secure_http2_port
grpcsharp_server_cancel_all_calls
grpcsharp_server_create
grpcsharp_server_credentials_release
grpcsharp_server_destroy
grpcsharp_server_register_completion_queue
grpcsharp_server_request_call
grpcsharp_server_shutdown_and_notify_callback
grpcsharp_server_start
grpcsharp_shutdown
grpcsharp_sizeof_grpc_event
grpcsharp_slice_buffer_adjust_tail_space
grpcsharp_slice_buffer_create
grpcsharp_slice_buffer_destroy
grpcsharp_slice_buffer_reset_and_unref
grpcsharp_slice_buffer_slice_count
grpcsharp_slice_buffer_slice_peek
grpcsharp_ssl_credentials_create
grpcsharp_ssl_server_credentials_create
grpcsharp_test_call_start_unary_echo
grpcsharp_test_callback
grpcsharp_test_nop
grpcsharp_test_override_method
grpcsharp_version_string

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 39KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 199KB - Virtual size: 198KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 881B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 754B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 283B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fortnite Cheat/grpc_csharp_ext.x86.dll
.dll windows:6 windows x86 arch:x86

56f92dece9fe60f68438cfe861c5a01f

Code Sign

0c:15:be:4a:15:bb:09:03:c9:01:b1:d6:c2:65:30:2f
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/11/2018, 00:00

Not After

17/11/2021, 12:00

Subject

CN=Google LLC,O=Google LLC,L=Mountain View,ST=ca,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/10/2019, 00:00

Not After

17/10/2030, 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

41:ef:d5:7d:65:2e:b1:a8:34:1e:d7:7c:ad:9b:a1:7a:a1:8d:73:71:49:4e:65:88:76:b8:3c:30:a4:56:f0:8f
Signer

Actual PE Digest

41:ef:d5:7d:65:2e:b1:a8:34:1e:d7:7c:ad:9b:a1:7a:a1:8d:73:71:49:4e:65:88:76:b8:3c:30:a4:56:f0:8f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

T:\src\github\grpc\workspace_csharp_ext_windows_x86\cmake\build\x86\grpc_csharp_ext.pdb

Imports

wsock32

getservbyport
recvfrom
connect
__WSAFDIsSet
gethostname
ioctlsocket
getsockopt
inet_ntoa
send
recv
WSASetLastError
setsockopt
listen
getsockname
getpeername
WSAGetLastError
socket
closesocket
bind
ntohs
ntohl
htonl
WSACleanup
WSAStartup
htons

ws2_32

WSARecvFrom
WSAConnect
WSASend
WSARecv
freeaddrinfo
getaddrinfo
WSAGetOverlappedResult
WSASocketA
WSAIoctl
inet_pton
inet_ntop

kernel32

FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileW
FindNextFileA
FindFirstFileExW
FindFirstFileExA
FindClose
GetFullPathNameA
GetFullPathNameW
GetCurrentDirectoryW
SetCurrentDirectoryW
SetStdHandle
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapReAlloc
DecodePointer
GetStdHandle
GetACP
GetStringTypeW
CloseHandle
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
QueryPerformanceCounter
QueryPerformanceFrequency
Sleep
SetEnvironmentVariableW
SetEvent
WaitForSingleObject
CreateEventA
CreateThread
GetCurrentProcessorNumber
GetSystemInfo
GetLastError
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
InitOnceExecuteOnce
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
LocalFree
FormatMessageA
GetEnvironmentVariableA
SetEnvironmentVariableA
SetLastError
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TlsAlloc
TlsGetValue
TlsSetValue
FreeLibrary
GetProcAddress
LoadLibraryW
ExpandEnvironmentStringsA
GetWindowsDirectoryA
GetVersionExA
GetTickCount
GetProcessHeap
WriteConsoleW
HeapSize
SetEndOfFile
OutputDebugStringW
OutputDebugStringA
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
FormatMessageW
WideCharToMultiByte
EncodePointer
RtlUnwind
RaiseException
InitializeCriticalSectionAndSpinCount
TlsFree
LoadLibraryExW
InterlockedPushEntrySList
InterlockedFlushSList
ReadFile
GetTimeZoneInformation
MultiByteToWideChar
SetFilePointerEx
GetConsoleMode
ReadConsoleW
WriteFile
GetConsoleCP
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
GetFileType
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetModuleFileNameW
HeapFree
HeapAlloc
SetConsoleCtrlHandler
GetCurrentThread

advapi32

RegQueryValueExA
RegEnumKeyExA
RegOpenKeyExA
RegCloseKey
SystemFunction036
RegGetValueA

Exports

Exports

_gprsharp_convert_clock_type@20
_gprsharp_free@4
_gprsharp_inf_future@4
_gprsharp_inf_past@4
_gprsharp_now@4
_gprsharp_sizeof_timespec@0
_grpcsharp_auth_context_peer_identity_property_name@4
_grpcsharp_auth_context_property_iterator@4
_grpcsharp_auth_context_release@4
_grpcsharp_auth_property_iterator_next@4
_grpcsharp_batch_context_create@0
_grpcsharp_batch_context_destroy@4
_grpcsharp_batch_context_recv_close_on_server_cancelled@4
_grpcsharp_batch_context_recv_initial_metadata@4
_grpcsharp_batch_context_recv_message_length@4
_grpcsharp_batch_context_recv_message_next_slice_peek@12
_grpcsharp_batch_context_recv_status_on_client_details@8
_grpcsharp_batch_context_recv_status_on_client_status@4
_grpcsharp_batch_context_recv_status_on_client_trailing_metadata@4
_grpcsharp_batch_context_reset@4
_grpcsharp_call_auth_context@4
_grpcsharp_call_cancel@4
_grpcsharp_call_cancel_with_status@12
_grpcsharp_call_credentials_release@4
_grpcsharp_call_destroy@4
_grpcsharp_call_get_peer@4
_grpcsharp_call_recv_initial_metadata@8
_grpcsharp_call_recv_message@8
_grpcsharp_call_send_close_from_client@8
_grpcsharp_call_send_initial_metadata@12
_grpcsharp_call_send_message@20
_grpcsharp_call_send_status_from_server@36
_grpcsharp_call_set_credentials@8
_grpcsharp_call_start_client_streaming@16
_grpcsharp_call_start_duplex_streaming@16
_grpcsharp_call_start_server_streaming@24
_grpcsharp_call_start_serverside@8
_grpcsharp_call_start_unary@24
_grpcsharp_channel_args_create@4
_grpcsharp_channel_args_destroy@4
_grpcsharp_channel_args_set_integer@16
_grpcsharp_channel_args_set_string@16
_grpcsharp_channel_check_connectivity_state@8
_grpcsharp_channel_create_call@40
_grpcsharp_channel_credentials_release@4
_grpcsharp_channel_destroy@4
_grpcsharp_channel_get_target@4
_grpcsharp_channel_watch_connectivity_state@32
_grpcsharp_completion_queue_create_async@0
_grpcsharp_completion_queue_create_sync@0
_grpcsharp_completion_queue_destroy@4
_grpcsharp_completion_queue_next@4
_grpcsharp_completion_queue_pluck@8
_grpcsharp_completion_queue_shutdown@4
_grpcsharp_composite_call_credentials_create@8
_grpcsharp_composite_channel_credentials_create@8
_grpcsharp_init@0
_grpcsharp_insecure_channel_create@8
_grpcsharp_metadata_array_add@16
_grpcsharp_metadata_array_count@4
_grpcsharp_metadata_array_create@4
_grpcsharp_metadata_array_destroy_full@4
_grpcsharp_metadata_array_get_key@12
_grpcsharp_metadata_array_get_value@12
_grpcsharp_metadata_credentials_create_from_plugin@4
_grpcsharp_metadata_credentials_notify_from_plugin@20
_grpcsharp_native_callback_dispatcher_init@4
_grpcsharp_override_default_ssl_roots@4
_grpcsharp_redirect_log@4
_grpcsharp_request_call_context_call@4
_grpcsharp_request_call_context_create@0
_grpcsharp_request_call_context_deadline@4
_grpcsharp_request_call_context_destroy@4
_grpcsharp_request_call_context_host@8
_grpcsharp_request_call_context_method@8
_grpcsharp_request_call_context_request_metadata@4
_grpcsharp_request_call_context_reset@4
_grpcsharp_secure_channel_create@12
_grpcsharp_server_add_insecure_http2_port@8
_grpcsharp_server_add_secure_http2_port@12
_grpcsharp_server_cancel_all_calls@4
_grpcsharp_server_create@4
_grpcsharp_server_credentials_release@4
_grpcsharp_server_destroy@4
_grpcsharp_server_register_completion_queue@8
_grpcsharp_server_request_call@12
_grpcsharp_server_shutdown_and_notify_callback@12
_grpcsharp_server_start@4
_grpcsharp_shutdown@0
_grpcsharp_sizeof_grpc_event@0
_grpcsharp_slice_buffer_adjust_tail_space@12
_grpcsharp_slice_buffer_create@0
_grpcsharp_slice_buffer_destroy@4
_grpcsharp_slice_buffer_reset_and_unref@4
_grpcsharp_slice_buffer_slice_count@4
_grpcsharp_slice_buffer_slice_peek@16
_grpcsharp_ssl_credentials_create@16
_grpcsharp_ssl_server_credentials_create@20
_grpcsharp_test_call_start_unary_echo@24
_grpcsharp_test_callback@4
_grpcsharp_test_nop@4
_grpcsharp_test_override_method@8
_grpcsharp_version_string@0

Sections

.text
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 624KB - Virtual size: 624KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 1024B - Virtual size: 813B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 805B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 260B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fortnite Cheat/mono.dll
.dll windows:5 windows x64 arch:x64

3e8606aebdaa9aa2060f1fcdf5893e7d

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

03:88:3b:fb:88:38:ac:27:c4:5b:74:c5:0f:42:b2:5b
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

11/07/2018, 00:00

Not After

10/07/2021, 23:59

Subject

CN=Unity Technologies Aps,OU=Core Developer Services,O=Unity Technologies Aps,L=København K,C=DK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

c2:be:c7:ec:3c:12:3c:cd:dd:26:ae:dc:08:5f:2a:48:36:18:77:96
Signer

Actual PE Digest

c2:be:c7:ec:3c:12:3c:cd:dd:26:ae:dc:08:5f:2a:48:36:18:77:96

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\buildslave\mono\build\builds\embedruntimes\win64\mono.pdb

Imports

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

ws2_32

__WSAFDIsSet
WSAGetLastError
select
socket
WSACleanup
WSAStartup
inet_addr
shutdown
setsockopt
getsockopt
sendto
WSASend
send
recvfrom
WSARecv
recv
WSAIoctl
connect
bind
getpeername
getsockname
ntohl
listen
WSACreateEvent
WSAEventSelect
WSACloseEvent
accept
ioctlsocket
closesocket
WSASocketW
getprotobyname
WSASetLastError
getservbyport
ntohs
gethostbyaddr
htons
getservbyname
htonl
inet_ntoa
gethostbyname
gethostname

psapi

EnumProcessModules
GetModuleBaseNameW
EnumProcesses
GetModuleInformation
GetModuleFileNameExW

winmm

timeEndPeriod
timeBeginPeriod
timeGetDevCaps
timeSetEvent

mswsock

TransmitFile

kernel32

FatalAppExitA
WideCharToMultiByte
FlsAlloc
FlsFree
FlsGetValue
IsValidCodePage
GetOEMCP
GetCPInfo
GetStartupInfoW
SetHandleCount
HeapDestroy
HeapCreate
HeapSetInformation
SetConsoleCtrlHandler
EncodePointer
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
FindFirstFileExW
HeapReAlloc
RtlUnwindEx
GetCommandLineA
FlsSetValue
SetThreadStackGuarantee
CreateDirectoryA
MoveFileA
DecodePointer
ExitProcess
LocalFileTimeToFileTime
FindFirstFileExA
GetDriveTypeA
InitializeCriticalSectionAndSpinCount
SetStdHandle
PeekNamedPipe
GetFileInformationByHandle
FileTimeToLocalFileTime
VirtualAlloc
VirtualFree
VirtualQuery
Sleep
GetSystemInfo
RtlDeleteFunctionTable
RtlInstallFunctionTableCallback
LocalFree
FormatMessageW
GetLastError
GetCurrentProcess
GetProcAddress
GetModuleHandleW
SetLastError
LoadLibraryW
SetErrorMode
FreeLibrary
CloseHandle
MapViewOfFile
CreateFileMappingW
UnmapViewOfFile
VirtualProtect
WaitForSingleObjectEx
ReleaseSemaphore
GetTickCount
GetSystemTimeAsFileTime
QueryPerformanceCounter
QueryPerformanceFrequency
LeaveCriticalSection
EnterCriticalSection
SetFileAttributesW
CopyFileW
DeleteFileW
WriteFile
CreateFileW
ResumeThread
InitializeCriticalSection
DeleteCriticalSection
GetFileType
GetModuleFileNameW
TlsGetValue
TlsSetValue
TlsAlloc
TlsFree
GetVersionExW
FindClose
GetFullPathNameA
GetFileAttributesW
GetFileAttributesExW
GetCurrentDirectoryW
ReadFile
SetFilePointer
FlushFileBuffers
GetFileSize
SetEndOfFile
SetFileTime
GetStdHandle
CreatePipe
DuplicateHandle
GetTempPathW
LockFile
UnlockFile
CreateDirectoryW
RemoveDirectoryW
FindNextFileW
SetCurrentDirectoryW
MoveFileW
ReplaceFileW
ResetEvent
SetEvent
CreateSemaphoreW
CreateEventW
SystemTimeToFileTime
GetTimeZoneInformation
GetComputerNameW
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetEnvironmentVariableW
GetLogicalDriveStringsW
GetDiskFreeSpaceExW
GetDriveTypeW
OutputDebugStringW
GlobalAlloc
GlobalReAlloc
GlobalFree
GetCurrentThreadId
OpenProcess
GetCurrentProcessId
DeleteFileA
CreateProcessW
GetProcessTimes
GetExitCodeProcess
GetProcessWorkingSetSize
SetProcessWorkingSetSize
TerminateProcess
GetPriorityClass
SetPriorityClass
GetCurrentThread
GetVolumeInformationW
LoadLibraryA
GetSystemDirectoryA
WaitForSingleObject
SleepEx
CreateMutexW
ReleaseMutex
OpenMutexW
OpenSemaphoreW
OpenEventW
OpenThread
GetExitCodeThread
ExitThread
WaitForMultipleObjectsEx
SignalObjectAndWait
QueueUserAPC
FreeConsole
GetThreadContext
RemoveVectoredExceptionHandler
SetUnhandledExceptionFilter
AddVectoredExceptionHandler
MultiByteToWideChar
DebugBreak
SuspendThread
CreateThread
GetVersion
RaiseException
GetEnvironmentVariableW
GetACP
FileTimeToSystemTime
HeapFree
HeapAlloc
CreateFileA
GetLocaleInfoW
LCMapStringW
GetFileAttributesA
GetConsoleCP
GetConsoleMode
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
GetStringTypeW
GetModuleFileNameA
GetProcessHeap
GetFullPathNameW
CompareStringW
SetEnvironmentVariableA
HeapSize
CreateProcessA
WriteConsoleW
FindFirstFileW
VerLanguageNameW

user32

WaitForInputIdle
MessageBoxA
SendMessageTimeoutW

advapi32

SetEntriesInAclW
GetNamedSecurityInfoW
FreeSid
BuildTrusteeWithSidW
GetEffectiveRightsFromAclW
GetLengthSid
CopySid
AllocateAndInitializeSid
RevertToSelf
ImpersonateLoggedOnUser
DuplicateToken
GetTokenInformation
OpenThreadToken
OpenProcessToken
LookupAccountSidW
CryptReleaseContext
CryptAcquireContextW
CryptGenRandom
CreateProcessWithLogonW
SetNamedSecurityInfoW

shell32

SHGetFolderPathW
ShellExecuteExW

ole32

CoUninitialize
CoTaskMemFree
CoTaskMemAlloc
CoCreateFreeThreadedMarshaler
CoInitializeEx
CoTaskMemRealloc

oleaut32

SafeArrayGetUBound
SafeArrayPtrOfIndex
SafeArrayGetLBound
SafeArrayPutElement
SafeArrayCreate
SafeArrayGetDim
SafeArrayDestroy
SysFreeString
SysAllocStringLen
SysStringLen

Exports

Exports

g_free
mono_add_internal_call
mono_alloc_special_static_data
mono_array_addr_with_size
mono_array_class_get
mono_array_clone
mono_array_element_size
mono_array_new
mono_array_new_full
mono_array_new_specific
mono_assemblies_cleanup
mono_assemblies_init
mono_assembly_close
mono_assembly_fill_assembly_name
mono_assembly_foreach
mono_assembly_get_assemblyref
mono_assembly_get_image
mono_assembly_get_main
mono_assembly_get_object
mono_assembly_getrootdir
mono_assembly_invoke_load_hook
mono_assembly_invoke_search_hook
mono_assembly_load
mono_assembly_load_from
mono_assembly_load_from_full
mono_assembly_load_full
mono_assembly_load_module
mono_assembly_load_reference
mono_assembly_load_references
mono_assembly_load_with_partial_name
mono_assembly_loaded
mono_assembly_loaded_full
mono_assembly_name_parse
mono_assembly_names_equal
mono_assembly_open
mono_assembly_open_full
mono_assembly_set_main
mono_assembly_setrootdir
mono_backtrace_from_context
mono_bitset_alloc_size
mono_bitset_clear
mono_bitset_clear_all
mono_bitset_clone
mono_bitset_copyto
mono_bitset_count
mono_bitset_equal
mono_bitset_find_first
mono_bitset_find_first_unset
mono_bitset_find_last
mono_bitset_find_start
mono_bitset_foreach
mono_bitset_free
mono_bitset_intersection
mono_bitset_intersection_2
mono_bitset_invert
mono_bitset_mem_new
mono_bitset_new
mono_bitset_set
mono_bitset_set_all
mono_bitset_size
mono_bitset_sub
mono_bitset_test
mono_bitset_test_bulk
mono_bitset_union
mono_bounded_array_class_get
mono_check_corlib_version
mono_class_array_element_size
mono_class_data_size
mono_class_describe_statics
mono_class_enum_basetype
mono_class_from_generic_parameter
mono_class_from_mono_type
mono_class_from_name
mono_class_from_name_case
mono_class_from_typeref
mono_class_get
mono_class_get_byref_type
mono_class_get_element_class
mono_class_get_event_token
mono_class_get_events
mono_class_get_field
mono_class_get_field_from_name
mono_class_get_field_token
mono_class_get_fields
mono_class_get_flags
mono_class_get_full
mono_class_get_image
mono_class_get_interfaces
mono_class_get_method_from_name
mono_class_get_method_from_name_flags
mono_class_get_methods
mono_class_get_name
mono_class_get_namespace
mono_class_get_nested_types
mono_class_get_nesting_type
mono_class_get_parent
mono_class_get_properties
mono_class_get_property_from_name
mono_class_get_property_token
mono_class_get_rank
mono_class_get_type
mono_class_get_type_token
mono_class_get_userdata
mono_class_get_userdata_offset
mono_class_inflate_generic_method
mono_class_inflate_generic_method_full
mono_class_inflate_generic_type
mono_class_init
mono_class_instance_size
mono_class_is_assignable_from
mono_class_is_blittable
mono_class_is_enum
mono_class_is_generic
mono_class_is_inflated
mono_class_is_subclass_of
mono_class_is_valuetype
mono_class_min_align
mono_class_name_from_token
mono_class_num_events
mono_class_num_fields
mono_class_num_methods
mono_class_num_properties
mono_class_set_userdata
mono_class_value_size
mono_class_vtable
mono_cli_rva_image_map
mono_code_manager_commit
mono_code_manager_destroy
mono_code_manager_foreach
mono_code_manager_invalidate
mono_code_manager_new
mono_code_manager_new_dynamic
mono_code_manager_reserve
mono_compile_method
mono_config_for_assembly
mono_config_parse
mono_config_parse_memory
mono_config_string_for_assembly_file
mono_context_get
mono_context_init
mono_context_set
mono_counters_dump
mono_counters_enable
mono_counters_register
mono_custom_attrs_construct
mono_custom_attrs_free
mono_custom_attrs_from_assembly
mono_custom_attrs_from_class
mono_custom_attrs_from_event
mono_custom_attrs_from_field
mono_custom_attrs_from_index
mono_custom_attrs_from_method
mono_custom_attrs_from_param
mono_custom_attrs_from_property
mono_custom_attrs_get_attr
mono_custom_attrs_get_attrs
mono_custom_attrs_has_attr
mono_debug_add_method
mono_debug_cleanup
mono_debug_close_mono_symbol_file
mono_debug_domain_create
mono_debug_domain_unload
mono_debug_find_method
mono_debug_free_source_location
mono_debug_init
mono_debug_lookup_method
mono_debug_lookup_source_location
mono_debug_open_image_from_memory
mono_debug_open_mono_symbols
mono_debug_print_stack_frame
mono_debug_print_vars
mono_debug_symfile_lookup_location
mono_debug_symfile_lookup_method
mono_debug_using_mono_debugger
mono_debugger_breakpoint_callback
mono_debugger_check_runtime_version
mono_debugger_cleanup
mono_debugger_event
mono_debugger_handle_exception
mono_debugger_initialize
mono_debugger_insert_breakpoint
mono_debugger_insert_breakpoint_full
mono_debugger_lock
mono_debugger_method_has_breakpoint
mono_debugger_remove_breakpoint
mono_debugger_run_finally
mono_debugger_unlock
mono_declsec_flags_from_assembly
mono_declsec_flags_from_class
mono_declsec_flags_from_method
mono_declsec_get_assembly_action
mono_declsec_get_class_action
mono_declsec_get_demands
mono_declsec_get_inheritdemands_class
mono_declsec_get_inheritdemands_method
mono_declsec_get_linkdemands
mono_declsec_get_method_action
mono_digest_get_public_token
mono_disasm_code
mono_disasm_code_one
mono_dl_fallback_register
mono_dl_fallback_unregister
mono_dllmap_insert
mono_domain_add_class_static_data
mono_domain_assembly_open
mono_domain_create
mono_domain_create_appdomain
mono_domain_finalize
mono_domain_foreach
mono_domain_free
mono_domain_get
mono_domain_get_by_id
mono_domain_get_id
mono_domain_has_type_resolve
mono_domain_is_unloading
mono_domain_owns_vtable_slot
mono_domain_set
mono_domain_set_internal
mono_domain_try_type_resolve
mono_domain_unload
mono_environment_exitcode_get
mono_environment_exitcode_set
mono_escape_uri_string
mono_event_get_add_method
mono_event_get_flags
mono_event_get_name
mono_event_get_object
mono_event_get_parent
mono_event_get_raise_method
mono_event_get_remove_method
mono_exception_from_name
mono_exception_from_name_domain
mono_exception_from_name_msg
mono_exception_from_name_two_strings
mono_exception_from_token
mono_field_from_token
mono_field_get_data
mono_field_get_flags
mono_field_get_name
mono_field_get_object
mono_field_get_offset
mono_field_get_parent
mono_field_get_type
mono_field_get_value
mono_field_get_value_object
mono_field_set_value
mono_field_static_get_value
mono_field_static_set_value
mono_file_map
mono_file_unmap
mono_free_method
mono_free_verify_list
mono_g_hash_table_destroy
mono_g_hash_table_foreach
mono_g_hash_table_foreach_remove
mono_g_hash_table_insert
mono_g_hash_table_lookup
mono_g_hash_table_lookup_extended
mono_g_hash_table_new
mono_g_hash_table_new_full
mono_g_hash_table_new_type
mono_g_hash_table_remove
mono_g_hash_table_replace
mono_g_hash_table_size
mono_gc_collect
mono_gc_collection_count
mono_gc_enable_events
mono_gc_get_generation
mono_gc_get_heap_size
mono_gc_get_used_size
mono_gc_is_finalizer_thread
mono_gc_max_generation
mono_gc_out_of_memory
mono_gc_wbarrier_arrayref_copy
mono_gc_wbarrier_generic_store
mono_gc_wbarrier_set_arrayref
mono_gc_wbarrier_set_field
mono_gc_wbarrier_value_copy
mono_gchandle_free
mono_gchandle_get_target
mono_gchandle_is_in_domain
mono_gchandle_new
mono_gchandle_new_weakref
mono_get_array_class
mono_get_boolean_class
mono_get_byte_class
mono_get_char_class
mono_get_config_dir
mono_get_corlib
mono_get_dbnull_object
mono_get_delegate_invoke
mono_get_double_class
mono_get_enum_class
mono_get_exception_appdomain_unloaded
mono_get_exception_argument
mono_get_exception_argument_null
mono_get_exception_argument_out_of_range
mono_get_exception_arithmetic
mono_get_exception_array_type_mismatch
mono_get_exception_bad_image_format
mono_get_exception_bad_image_format2
mono_get_exception_cannot_unload_appdomain
mono_get_exception_class
mono_get_exception_divide_by_zero
mono_get_exception_execution_engine
mono_get_exception_file_not_found
mono_get_exception_file_not_found2
mono_get_exception_index_out_of_range
mono_get_exception_invalid_cast
mono_get_exception_invalid_operation
mono_get_exception_io
mono_get_exception_missing_field
mono_get_exception_missing_method
mono_get_exception_not_implemented
mono_get_exception_not_supported
mono_get_exception_null_reference
mono_get_exception_overflow
mono_get_exception_reflection_type_load
mono_get_exception_security
mono_get_exception_serialization
mono_get_exception_stack_overflow
mono_get_exception_synchronization_lock
mono_get_exception_thread_abort
mono_get_exception_thread_interrupted
mono_get_exception_thread_state
mono_get_exception_type_initialization
mono_get_exception_type_load
mono_get_inflated_method
mono_get_int16_class
mono_get_int32_class
mono_get_int64_class
mono_get_intptr_class
mono_get_machine_config
mono_get_method
mono_get_method_constrained
mono_get_method_full
mono_get_object_class
mono_get_root_domain
mono_get_sbyte_class
mono_get_single_class
mono_get_special_static_data
mono_get_string_class
mono_get_thread_class
mono_get_uint16_class
mono_get_uint32_class
mono_get_uint64_class
mono_get_uintptr_class
mono_get_void_class
mono_guid_to_string
mono_image_add_to_name_cache
mono_image_addref
mono_image_close
mono_image_ensure_section
mono_image_ensure_section_idx
mono_image_get_assembly
mono_image_get_entry_point
mono_image_get_filename
mono_image_get_guid
mono_image_get_name
mono_image_get_public_key
mono_image_get_resource
mono_image_get_strong_name
mono_image_get_table_info
mono_image_get_table_rows
mono_image_has_authenticode_entry
mono_image_init
mono_image_init_name_cache
mono_image_is_dynamic
mono_image_load_file_for_image
mono_image_loaded
mono_image_loaded_by_guid
mono_image_loaded_by_guid_full
mono_image_loaded_full
mono_image_lookup_resource
mono_image_open
mono_image_open_from_data
mono_image_open_from_data_full
mono_image_open_from_data_with_name
mono_image_open_full
mono_image_rva_map
mono_image_strerror
mono_image_strong_name_position
mono_image_verify_tables
mono_images_cleanup
mono_images_init
mono_init
mono_init_from_assembly
mono_init_version
mono_inst_name
mono_install_assembly_load_hook
mono_install_assembly_postload_refonly_search_hook
mono_install_assembly_postload_search_hook
mono_install_assembly_preload_hook
mono_install_assembly_refonly_preload_hook
mono_install_assembly_refonly_search_hook
mono_install_assembly_search_hook
mono_install_runtime_cleanup
mono_is_debugger_attached
mono_jit_cleanup
mono_jit_exec
mono_jit_info_get_code_size
mono_jit_info_get_code_start
mono_jit_info_get_method
mono_jit_info_table_find
mono_jit_init
mono_jit_init_version
mono_jit_parse_options
mono_jit_set_trace_options
mono_jit_thread_attach
mono_ldstr
mono_ldtoken
mono_load_remote_field
mono_load_remote_field_new
mono_loader_error_prepare_exception
mono_loader_get_last_error
mono_locks_dump
mono_lookup_internal_call
mono_lookup_pinvoke_call
mono_main
mono_marshal_string_to_utf16
mono_mb_free
mono_md5_final
mono_md5_get_digest
mono_md5_get_digest_from_file
mono_md5_init
mono_md5_update
mono_mempool_alloc
mono_mempool_alloc0
mono_mempool_contains_addr
mono_mempool_destroy
mono_mempool_empty
mono_mempool_get_allocated
mono_mempool_invalidate
mono_mempool_new
mono_mempool_stats
mono_mempool_strdup
mono_metadata_blob_heap
mono_metadata_cleanup
mono_metadata_compute_size
mono_metadata_custom_attrs_from_index
mono_metadata_declsec_from_index
mono_metadata_decode_blob_size
mono_metadata_decode_row
mono_metadata_decode_row_col
mono_metadata_decode_signed_value
mono_metadata_decode_table_row
mono_metadata_decode_table_row_col
mono_metadata_decode_value
mono_metadata_encode_value
mono_metadata_events_from_typedef
mono_metadata_field_info
mono_metadata_free_array
mono_metadata_free_marshal_spec
mono_metadata_free_method_signature
mono_metadata_free_mh
mono_metadata_free_type
mono_metadata_generic_class_is_valuetype
mono_metadata_get_constant_index
mono_metadata_get_generic_param_row
mono_metadata_get_marshal_info
mono_metadata_get_param_attrs
mono_metadata_guid_heap
mono_metadata_implmap_from_method
mono_metadata_init
mono_metadata_interfaces_from_typedef
mono_metadata_load_generic_param_constraints
mono_metadata_load_generic_params
mono_metadata_locate
mono_metadata_locate_token
mono_metadata_methods_from_event
mono_metadata_methods_from_property
mono_metadata_nested_in_typedef
mono_metadata_nesting_typedef
mono_metadata_packing_from_typedef
mono_metadata_parse_array
mono_metadata_parse_custom_mod
mono_metadata_parse_field_type
mono_metadata_parse_marshal_spec
mono_metadata_parse_method_signature
mono_metadata_parse_method_signature_full
mono_metadata_parse_mh
mono_metadata_parse_mh_full
mono_metadata_parse_param
mono_metadata_parse_signature
mono_metadata_parse_type
mono_metadata_parse_type_full
mono_metadata_parse_typedef_or_ref
mono_metadata_properties_from_typedef
mono_metadata_signature_alloc
mono_metadata_signature_dup
mono_metadata_signature_equal
mono_metadata_string_heap
mono_metadata_token_from_dor
mono_metadata_translate_token_index
mono_metadata_type_equal
mono_metadata_type_hash
mono_metadata_typedef_from_field
mono_metadata_typedef_from_method
mono_metadata_user_string
mono_method_body_get_object

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 850KB - Virtual size: 849KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 375KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE

data
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Fortnite Cheat/netstandard.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:00:00:00:c1:09:f8:02:41:bb:4d:aa:dc:00:00:00:00:00:c1
Certificate

Issuer

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/09/2016, 17:58

Not After

07/09/2018, 17:58

Subject

CN=Microsoft Time-Stamp Service,OU=AOC+OU=nCipher DSE ESN:12E7-3064-6112,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

33:00:00:01:79:7c:2e:57:4e:52:e1:ca:d6:00:01:00:00:01:79
Certificate

Issuer

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:11

Not After

11/08/2018, 20:11

Subject

CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:33:26:1a:00:00:00:00:00:31
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

31/08/2010, 22:19

Not After

31/08/2020, 22:29

Subject

CN=Microsoft Code Signing PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:16:68:34:00:00:00:00:00:1c
Certificate

Issuer

CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

Not Before

03/04/2007, 12:53

Not After

03/04/2021, 13:03

Subject

CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

33:00:00:00:c4:e9:89:f8:7a:81:50:e9:ff:00:00:00:00:00:c4
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

11/08/2017, 20:20

Not After

11/08/2018, 20:20

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8e:56:4d:05:69:0c:fa:09:46:27:ef:0b:e8:36:5f:b0:7b:27:1c:55:01:fc:39:d0:19:d8:78:be:b9:ce:56:66
Signer

Actual PE Digest

8e:56:4d:05:69:0c:fa:09:46:27:ef:0b:e8:36:5f:b0:7b:27:1c:55:01:fc:39:d0:19:d8:78:be:b9:ce:56:66

Digest Algorithm

sha256

PE Digest Matches

true

8d:e0:1e:69:c8:d1:ea:17:33:ff:e8:81:e3:03:2e:80:ff:4c:05:f6
Signer

Actual PE Digest

8d:e0:1e:69:c8:d1:ea:17:33:ff:e8:81:e3:03:2e:80:ff:4c:05:f6

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

72c4e339b7af8ab1ed2eb3821c98713a

Code Sign

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16Certificate

Extended Key Usages

Key Usages

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6eCertificate

Extended Key Usages

Key Usages

bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

94:50:7e:fc:66:32:0f:bc:29:8b:af:c0:eb:82:2f:7c:6b:3c:00:85:86:e1:07:16:2c:00:74:b9:00:5e:49:f7Signer

Headers

DLL Characteristics

File Characteristics

Imports

user32

comctl32

kernel32

advapi32

gdi32

Sections

.text Size: 168KB - Virtual size: 167KB

.rdata Size: 75KB - Virtual size: 74KB

.data Size: 3KB - Virtual size: 20KB

.pdata Size: 9KB - Virtual size: 8KB

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 2KB - Virtual size: 1KB

dae02f32a21e03ce65412f6e56942daa

Code Sign

0c:15:be:4a:15:bb:09:03:c9:01:b1:d6:c2:65:30:2fCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

2d:fb:11:91:fc:4c:85:84:cf:91:a6:99:87:24:a2:5a:d7:00:d3:6b:9b:a2:75:e7:0b:91:a5:70:da:09:72:beSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mscoree

Sections

.text Size: 41KB - Virtual size: 40KB

.rsrc Size: 1024B - Virtual size: 932B

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

0c:15:be:4a:15:bb:09:03:c9:01:b1:d6:c2:65:30:2fCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

a8:7b:53:f2:e0:71:aa:4d:53:42:5d:db:b3:81:d2:ca:92:19:8b:22:8e:82:6b:fe:6c:a0:11:9a:6d:65:a4:6bSigner

Headers

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Certificate

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e
Certificate

bf:b1:50:01:bb:f5:92:d4:96:2a:77:97:ea:73:6f:a3
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

94:50:7e:fc:66:32:0f:bc:29:8b:af:c0:eb:82:2f:7c:6b:3c:00:85:86:e1:07:16:2c:00:74:b9:00:5e:49:f7
Signer

.text
Size: 168KB - Virtual size: 167KB

.rdata
Size: 75KB - Virtual size: 74KB

.data
Size: 3KB - Virtual size: 20KB

.pdata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 2KB - Virtual size: 1KB

0c:15:be:4a:15:bb:09:03:c9:01:b1:d6:c2:65:30:2f
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

2d:fb:11:91:fc:4c:85:84:cf:91:a6:99:87:24:a2:5a:d7:00:d3:6b:9b:a2:75:e7:0b:91:a5:70:da:09:72:be
Signer

.text
Size: 41KB - Virtual size: 40KB

.rsrc
Size: 1024B - Virtual size: 932B

.reloc
Size: 512B - Virtual size: 12B

0c:15:be:4a:15:bb:09:03:c9:01:b1:d6:c2:65:30:2f
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

a8:7b:53:f2:e0:71:aa:4d:53:42:5d:db:b3:81:d2:ca:92:19:8b:22:8e:82:6b:fe:6c:a0:11:9a:6d:65:a4:6b
Signer

.text
Size: 451KB - Virtual size: 451KB

.rsrc
Size: 1024B - Virtual size: 908B

.reloc
Size: 512B - Virtual size: 12B

33:00:00:00:64:47:84:94:86:db:41:19:38:00:00:00:00:00:64
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

e3:71:ab:6d:fc:3b:f5:11:50:0b:77:bf:5e:dc:02:39:7e:10:a4:8b:50:b6:99:19:4c:f2:f0:65:62:5e:13:eb
Signer

.text
Size: 30KB - Virtual size: 30KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 12B

.text
Size: 67KB - Virtual size: 66KB

.rdata
Size: 32KB - Virtual size: 32KB

.data
Size: 5KB - Virtual size: 14KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 512B - Virtual size: 436B

.reloc
Size: 1024B - Virtual size: 996B

.text
Size: 1.6MB - Virtual size: 1.6MB

.rsrc
Size: 1024B - Virtual size: 1012B

.reloc
Size: 512B - Virtual size: 12B

02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Certificate

07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Certificate

0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate