dbb8a5366531e703a38f52ecd1af29ee15d99ca1767ad09a7f855fa04b41b683
- SHA256 dbb8a5366531e703a38f52ecd1af29ee15d99ca1767ad09a7f855fa04b41b683
Overview
overview
10Static
static
3print20251...��.bat
windows10-2004-x64
10print20251...��.bat
windows11-21h2-x64
10print20251...ET.dll
windows10-2004-x64
1print20251...ET.dll
windows11-21h2-x64
1print20251...VC.exe
windows10-2004-x64
6print20251...VC.exe
windows11-21h2-x64
6print20251...to.dll
windows10-2004-x64
1print20251...to.dll
windows11-21h2-x64
1print20251...on.dll
windows10-2004-x64
1print20251...on.dll
windows11-21h2-x64
1print20251...er.dll
windows10-2004-x64
1print20251...er.dll
windows11-21h2-x64
1print20251...er.dll
windows10-2004-x64
1print20251...er.dll
windows11-21h2-x64
1print20251...VC.exe
windows10-2004-x64
1print20251...VC.exe
windows11-21h2-x64
1print20251...ll.bat
windows10-2004-x64
8print20251...ll.bat
windows11-21h2-x64
8print20251...rp.dll
windows10-2004-x64
1print20251...rp.dll
windows11-21h2-x64
1print20251...es.dll
windows10-2004-x64
1print20251...es.dll
windows11-21h2-x64
1print20251...um.dll
windows10-2004-x64
1print20251...um.dll
windows11-21h2-x64
1Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
print20251118/AA-点击这里启动打印程序.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
print20251118/AA-点击这里启动打印程序.bat
Resource
win11-20260513-en
windows11-21h2-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
print20251118/AutoUpdater.NET.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
print20251118/AutoUpdater.NET.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
print20251118/BLMPrinterSVC.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral6
Sample
print20251118/BLMPrinterSVC.exe
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral7
Sample
print20251118/BouncyCastle.Crypto.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
print20251118/BouncyCastle.Crypto.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
print20251118/Newtonsoft.Json.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
print20251118/Newtonsoft.Json.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
print20251118/PdfiumViewer.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
print20251118/PdfiumViewer.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
print20251118/QRCoder.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
print20251118/QRCoder.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
print20251118/app.publish/BLMPrinterSVC.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral16
Sample
print20251118/app.publish/BLMPrinterSVC.exe
Resource
win11-20260513-en
windows11-21h2-x64
2 signatures
150 seconds
Behavioral task
behavioral17
Sample
print20251118/fuxin_install.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral18
Sample
print20251118/fuxin_install.bat
Resource
win11-20260513-en
windows11-21h2-x64
19 signatures
150 seconds
Behavioral task
behavioral19
Sample
print20251118/itextsharp.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
print20251118/itextsharp.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
print20251118/nl/PdfiumViewer.resources.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
print20251118/nl/PdfiumViewer.resources.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
print20251118/pdfium.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
print20251118/pdfium.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target dbb8a5366531e703a38f52ecd1af29ee15d99ca1767ad09a7f855fa04b41b683
- Size 8.6MB
- Sample260528-v855tsht6l
- SHA256 dbb8a5366531e703a38f52ecd1af29ee15d99ca1767ad09a7f855fa04b41b683
- MD5 b30cee75a2113d86b951bbec16b6790c
- SHA1 0456d8c8f66f6c91e139a7162eee880c00dbd845
- SHA512 318d24c8187c00b01d74ec85643ffe9ef26ded9085a4b563dbf127ed4e4900424b03bec734f402ad9fcadd2253d6ad9e2ec3fbd32573f55d1812d35101f925b6
- SSDEEP 196608:gfVC69Pc05Dv8v0trneCSS95ripxitV02ILwX+SwFpMaJ8sGTc4yjcFnAw5W:KC0A8rneCT5rsgtDILwXFwsaJ8i4yjcC
- TLSH T1B4963308EA9C7F03DD7B473BDE8FEB8787D9A09B63504C359A0552CEB5DEA00B485660
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 8 IoCs
Checks for missing Authenticode signature.
resource unpack001/print20251118/AutoUpdater.NET.dll unpack001/print20251118/BLMPrinterSVC.exe unpack001/print20251118/BouncyCastle.Crypto.dll unpack001/print20251118/PdfiumViewer.dll unpack001/print20251118/QRCoder.dll unpack001/print20251118/itextsharp.dll unpack001/print20251118/nl/PdfiumViewer.resources.dll unpack001/print20251118/pdfium.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/print20251118/app.publish/BLMPrinterSVC.exe
File Explorer
-
dbb8a5366531e703a38f52ecd1af29ee15d99ca1767ad09a7f855fa04b41b683.zip 8.6MB
-
print20251118/AA-点击这里启动打印程序.bat.bat 2KB
-
print20251118/AutoUpdater.NET.dll.dll 410KB
-
print20251118/AutoUpdater.NET.pdb71KB
-
print20251118/AutoUpdater.NET.xml.xml 32KB
-
print20251118/BLMConfig.txt3B
-
print20251118/BLMPrinterSVC.application1KB
-
print20251118/BLMPrinterSVC.exe.exe 101KB
-
print20251118/BLMPrinterSVC.exe.config.xml 538B
-
print20251118/BLMPrinterSVC.exe.manifest9KB
-
print20251118/BLMPrinterSVC.pdb243KB
-
print20251118/BouncyCastle.Crypto.dll.dll 2.5MB
-
print20251118/Newtonsoft.Json.dll.dll 683KB
-
print20251118/Newtonsoft.Json.xml.xml 691KB
-
print20251118/PdfiumViewer.dll.dll 113KB
-
print20251118/PdfiumViewer.xml.xml 60KB
-
print20251118/QRCoder.dll.dll 150KB
-
print20251118/app.publish/BLMPrinterSVC.exe.exe 101KB
-
print20251118/fuxin_install.bat.bat 999B
-
print20251118/itextsharp.dll.dll 2.5MB
-
print20251118/itextsharp.xml.xml 2.0MB
-
print20251118/nl/PdfiumViewer.resources.dll.dll 4KB
-
print20251118/pdfium.dll.dll 13.2MB
print20251118/AA-点击这里启动打印程序.bat
- SHA256 c0a26d9852c08d1eb6ed95e6905740c0c73436d19f128140c3c54ca9dfeeef91
- MD5 4a763732a0fb6b5f2277898b8a4d56d4
- SHA1 f32a748f90573439b6d219e611581cb3a4c5c278
- SHA512 11c1b1454d7b6cf50b2c0fc2680565baff90a561746b1119db954e4d9ad9fc9f19f1d00024b8d38358b48bb475e40d452a9fcdcf9c4a3b68f8d06854e1896176
- TLSH T1FD51872A280BCD519F60E160F9050A13FD5F5B8F6120DFA67CD7815457A78E26CFC5CA
- MD5 SHA1 SHA512 TLSH
print20251118/AutoUpdater.NET.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7fba2526db54ddb6b4bccae1cb0b7becfe9e979951e45dba35395b371980a171
- MD5 7d1d695b7e1759305eca5bcc1bd43684
- SHA1 d89361059af68a05d1ae2b812bd37a6d6515f00c
- SHA512 3fb6d7347087157f431e7467fd60c45207c66c92c7d7e99c244f24d90c0cd9762f98bcf964e31a2c3d9227058c0f377f220b4fbc76a73d541140daf399421440
- SSDEEP 6144:7dJTqXFL56jT5LP2hn7gQBWFHagXLDklox2wMV0xY:nOb6jTFP5
- TLSH T1D29419127BE94229D4B33AF6583592914636BE65BE10CA6E14B4320D5E73223CF71F2F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
425086
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
c:\projects\AutoUpdater.NET\AutoUpdater.NET\obj\Release\net45\AutoUpdater.NET.pdb
mscoree
_CorDllMain
Name
.text
Size
407KB
Virtual Size
407KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
print20251118/AutoUpdater.NET.pdb
- SHA256 36ba6df9aabafa61cb62871d3b82db832d5e1fae0546f21e3c66d52afc30eeb5
- MD5 927ade3e1a8befdd77befdb9146faf30
- SHA1 b21e36d65e39a2cebe0bc7ea45cae1cdb9c6028d
- SHA512 97d641cb2096a11811f2c07e6f6b1799b1e4467a9325fb7e53bd3c6041bbf1088e316148d3a68563c77595b759689881e5407efd76393f6e9c9c225de8725325
- SSDEEP 768:k9cl0lqD9LL8tZLhk2sQormQ7MUPtznLghsNCWYoI:kackLs39wY+CsNHI
- TLSH T1F2632147FB81CA3AC0B84678419F5F2D1238FD48678257AB6798B52C3EF335A1D4E258
- MD5 SHA1 SHA512 SSDEEP TLSH
print20251118/AutoUpdater.NET.xml
- SHA256 883540a1a241f29b84784798943d400c94f5014f6eae4a2b887d9e68d34a0937
- MD5 eeaa7e97b350a7204c1e1c7669e3cae1
- SHA1 a606ed80675b0d67eb992a06f97bbe04d13c0b07
- SHA512 f3a5c199a89edc7dc79b3a3518b8f0fa05b57bd3c5b6b1e6a2fa8c5c47bff1d5107c16eca3f9baf0ae713740bf04a0ea996bf1123f9f09eaf9594d713499e19c
- SSDEEP 384:m3aH5+mVo0bX9pf37m/WOQkT5z3IKcf74uoMugdQGQlY4:F+OPm/YktBGq
- TLSH T1B6E28C45B6C0DE380C72022B5E64B8E4FF55082B6259682A71DD2F6B5F738C762EF5B0
- MD5 SHA1 SHA512 SSDEEP TLSH
print20251118/BLMConfig.txt
- SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
- MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
- SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
- SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
- MD5 SHA1 SHA512
print20251118/BLMPrinterSVC.application
- SHA256 fa7d47de8ae4f71830432831bf0c5e42ce06862fd3ea0f4d3df22d9d9914fed8
- MD5 db3889abfcefec6eaf602c74550f6adb
- SHA1 b08fe2d8e5645f0b73ce8627e888972399085987
- SHA512 73f59c5ae74c43014931d17e60162947baa2b325333a9e445af1e3b2be6a22f3be02326d7ec895a96e3fc9d0baa47bb80d421f3283ffda761334a65d5ffa4560
- TLSH T18C31C091C188B856E3219090B9D2F012554977A700FD44DC78EC5D9F8B97ED8C6432F3
- MD5 SHA1 SHA512 TLSH
print20251118/BLMPrinterSVC.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 6fec49e6a3967c60312ec3a4be1cc27d678548e28807ffa72045a7a5624f2c76
- MD5 fe4f09ef6a6989a454cd5cc11f4a46f1
- SHA1 c9bfd5fb9ffc3f6c542733dabd4a39ee05b6bdd3
- SHA512 655ded90805ee6978c85ede00ade95512ef85289a6aab03c8102040fa2620f0b090e366e51eda3d9a770be71d8b6902f9b905598a032a359ce31e49d3e60e106
- SSDEEP 3072:9BNrO/jov199bNGdWMSVBg0Wykh4Rkh4JSkh43:9r4Mv/9bNGdWMSGN4u4T4
- TLSH T1BBA37C16B3E8C726CAEF077DA4B152154732E927D632EB1A1BD8649D2C737A04805BF3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Minor OS version
0
Major OS version
4
Entry point
101954
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Projects\PrintClient\PrinterMonitorSvc\obj\Debug\BLMPrinterSVC.pdb
mscoree
_CorExeMain
Name
.text
Size
92KB
Virtual Size
91KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
print20251118/BLMPrinterSVC.exe.config
- SHA256 3ce12b999a0f3fa02fef0432ed2136e7ea055cd349d4f238b3985d0ff6307050
- MD5 0a28bb95f949e7ca3ebc469efe55ca06
- SHA1 7a8828cb5c2360f7563982820953c858b990ea1f
- SHA512 2a6049dd6f7ecac09d50fc907be34d4e3c0941525b1a8d4c08435996713a5802d1cc298c7df73f980bc8661569200c6830c074fbe134f0b73e2357c09fda4901
- TLSH T125F09E1094C87E66CF3146B33A76A420EF791373244C044CF0AF7A9B4F3566A4217376
- MD5 SHA1 SHA512 TLSH
print20251118/BLMPrinterSVC.exe.manifest
- SHA256 e445b9c4f0bbf66825ecbdd1cc184d25912b621927ab78e5775aaa440ce9ea18
- MD5 d9af44d24ad0a8c2dddc4e4c8ccabb7f
- SHA1 588e87224f0e8c97b3cdfe1e9c39e9c8112e8a05
- SHA512 99c08a73f28db63efb04da6ae4fe8f9731023259add029f3615617dd046ad2843edc534f8e2fbc1bd6817f81b01050aaac008c8b556389175c7ead5bc3eafd97
- SSDEEP 96:xWLwOhoyTkYTTiOLBa5tlq/wSyIkMckQRk8nktkkjOIkLkLDdnCkck2BkkdkrCLF:oRXTTA5to/6MJQ6pukjogLRrJ2Kk+W66
- TLSH T14522124688C0BD21533241C4BFF2DD25FE066B6305AE14CABC5C5A9F9F96948DA832B7
- MD5 SHA1 SHA512 SSDEEP TLSH
print20251118/BLMPrinterSVC.pdb
- SHA256 c806f291199f110991f389b6c626e6e441d04121b1288d99413c5d67309e868b
- MD5 992f7e5221a21ae4cd6d103f0d262ea7
- SHA1 15d2651e354760a44bdbb0696393e44bfe6a44b4
- SHA512 ece835d8ad37be78f9664462a98390db9a936e60fa739b8a97583acf5865c30cc0a5e91df2920a09addfc8131ee634a52322805286c5ef62ab20984fab05eacc
- SSDEEP 1536:MFxB5vhDUC9MA0rgaP/vZSwpMiZpgSqKGnN6g3k8+Go2xKZp8qk8+G:oJUCkPHZdpMiTgSfGn+9Tvn+
- TLSH T12E348147BB01C933CC99A634D69B8F1C573AE14196E2930F338AB4AD3DE37A55E153A0
- MD5 SHA1 SHA512 SSDEEP TLSH
print20251118/BouncyCastle.Crypto.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 333903c7d22a27098e45fc64b77a264aa220605cfbd3e329c200d7e4b42c881c
- MD5 f0b3e112ce4807a28e2b5d66a840ed7f
- SHA1 54a6743781fd4ceb720331fce92f16186931192d
- SHA512 dc8ec9754c5e86f7e54e75ff3e5859c1b057f90e9c41788037b944a5db2cb3b70060763d0efcbe55ec595bcc47a9c0ff847a4876821470ca1659c31afd5b0190
- SSDEEP 49152:OSSJ+G1PjodumkjD6Oc0mqHZwueCtbu9kQN:6xodumo6Lr
- TLSH T132C53A1877F40613D6BAE7B595F09021A3F0F46EB393FB0B6591A7B50C13BA24C816A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2603454
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
print20251118/Newtonsoft.Json.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
- MD5 6815034209687816d8cf401877ec8133
- SHA1 1248142eb45eed3beb0d9a2d3b8bed5fe2569b10
- SHA512 3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
- SSDEEP 12288:Lf9WGsSVSM2mxL2nRiOr8gUckc6V/g2GhBzj05cH:7XNL2PVh6B+Bzjmc
- TLSH T138E44A41A7F88F27D19E6379B430890A47F6F80BA2B5EF4F5908E9A91C937508D40B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
8c:10:56:8e:61:ed:4a:db:b2:78:fe:51:cd:63:62:ed:e4:18:e6:f9:b5:44:af:42:d1:80:41:52:2d:66:12:81
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Chains
Nov 9, 2019
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
02:ac:5c:26:6a:0b:40:9b:8f:0b:79:f2:ae:46:25:77
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Nov 10, 2006 - Nov 10, 2031
Subject
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Serial Number
07:b0:41:8d:a5:1e:14:8c:33:1b:bc:de:b7:13:83:23
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 27, 2018 - Apr 27, 2028
Subject
SERIALNUMBER=603 389 068,CN=Json.NET (.NET Foundation),O=Json.NET (.NET Foundation),L=Redmond,ST=wa,C=US
Serial Number
0a:71:a1:b0:c2:96:f5:c7:90:65:47:0a:3c:20:53:7e
Issuer
CN=.NET Foundation Projects Code Signing CA,O=.NET Foundation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 25, 2018 - Oct 29, 2021
Subject
CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US
Serial Number
04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Oct 1, 2019 - Oct 17, 2030
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
0
Major OS version
4
Entry point
696798
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/Src/Newtonsoft.Json/obj/Release/net45/Newtonsoft.Json.pdb
mscoree
_CorDllMain
Name
.text
Size
673KB
Virtual Size
673KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
print20251118/Newtonsoft.Json.xml
- SHA256 e3c9cb0cbf4b3be20b6030f3a4872edd81e042048d2d19732eac3eeb9779dc0b
- MD5 ad1a946cdbe4fc83907cf558fb80a37f
- SHA1 9b6ab559cccce89e989259e356c55be6e370f1db
- SHA512 3bbbd262f3fc669bb0709963788ccca67e17fe28828ff72ca32f1d6d410a3cf76950d126feb39f204163eb5b43b07f54bc1dd4df7f4132933dbb61c054e9c1e0
- SSDEEP 6144:XqqUmk/RikFaG0rH3jGHdl0/IBHNpgVIeR0R+CRFo9TA82m5Kj+sJjoqoyO185QA:DUn
- TLSH T13EE4E02577C4CB220C7A012A4D1CF0C5FF205AB316192CA635CC5DDB9F7AEA652FB6A1
- MD5 SHA1 SHA512 SSDEEP TLSH
print20251118/PdfiumViewer.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 65f1fcbf4a836cf37a0e8ca32badc0fb81b9387014ce141cc05e5da711486ba8
- MD5 82e7c3a1caad77137d7fa643e652a9bd
- SHA1 2c4114d52a151ef6a7b104e808bcf9a1564c6b1c
- SHA512 e3c7b7aa595f5cb510011d13e27824d48011ff7cbfcfdffa3ecd1b8bef3e0c2726601ce013668095ca94ef27618320e099b40fdf6a63e84498644da76e26958a
- SSDEEP 3072:TzrynKP/Cc02SLypyF4PCUW8nDki1UTChSilHd:T3sKXGLypQqfqip
- TLSH T1C9B35C6137688A2BD99F467AE034015183B2A646B243E79EADCC75FC5D73B8707027E3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
121598
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Projects\PdfiumViewer\PdfiumViewer\obj\Release\PdfiumViewer.pdb
mscoree
_CorDllMain
Name
.text
Size
111KB
Virtual Size
110KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
972B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
print20251118/PdfiumViewer.xml
- SHA256 4c6020a3c1cd3957ee2fcab487101ca5ed63c8352cec7343852f12fdec506af9
- MD5 9f750ca7265b3f5f53f5f5282043ffdd
- SHA1 1acbd4d9a87559b0a8910055f014d4a27fe01078
- SHA512 adba9543fbd4a9c02c2b33b82b83b25da06e96f89678cc6bb6dd5bd7b64b98f385b7334e029fbb3a9132ffd371d2d68853369fbee9ed8b7c93793d9b2c6c0618
- SSDEEP 384:WSXVkXGUk9lWSDx46zZlXVTXGSyYJ9VWkHfFGWjkKsE+7XnjpqgwOXwc1ihdAGkC:WOBVZT6Vc8jyJ
- TLSH T19E539C2536C64D300C760617BEACF5D1FEA60923319AF42A35CD2E276F7ACD652AF910
- MD5 SHA1 SHA512 SSDEEP TLSH
print20251118/QRCoder.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5ae2792c76262943a4e34140bbd64b2aa7d9ed5c5822680c00d9eaa322412680
- MD5 4885a17363679aab6211d5960bb2bf72
- SHA1 620c11c5c464c10eb7675b6c4b873560e8026551
- SHA512 eef8683fe19b35262cd93e75e6bf0f17ba4e5dbc158aaa093c80192ee33a39b383a5c8b1eda027596b4c9b98c293ac922f6f6f6ec99d969a95e66da85c32c37d
- SSDEEP 3072:xV2CN+YEkkcZne94i2TYD0iljyBmqTAPh+QYQUIkL5a3wX2oM:xV2CNRn04i2cD0cjMmNmIkMG
- TLSH T12BE35A2977E8CF06E6BF2B79E8B010404B75F456BA36D75F0DC8A69D2592B8088107F7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
148474
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\QRCoder\QRCoder\QRCoder\obj\Release\net40\QRCoder.pdb
mscoree
_CorDllMain
Name
.text
Size
148KB
Virtual Size
147KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
print20251118/app.publish/BLMPrinterSVC.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0d90f0ae18a6c961500eba6ba3583ff6a89f97a4c8e3d69ca3e9d01e29ba0c7f
- MD5 4d2fef537efe52c0cc36639f29336657
- SHA1 9e5635af44632856b95d75fa746f8fdedb923752
- SHA512 d7c72a18bdcf88965aac7b20f608cfd5197a8be786ba62a18586b8879937bf9d42a620528ff084a9c9ccaea2924ba706d585deb65c425ca4251ab8cb810b9a7e
- SSDEEP 3072:OHhxFJ9sTqaeTwwI9wb9bfGdWaSvBga62kh4Rkh4Akh43m:O3FJ9smaeTF9bfGdWaSSp4u4r42
- TLSH T1ABA37C1663E8C716CEFF17BDA47112124771E927D172FB1A2B88609D2C63BA08A147F7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
db:67:f8:11:13:b0:fc:0b:79:6e:55:99:0c:1b:be:8a:d9:00:d9:c6:26:9e:46:9a:87:59:ee:15:43:c4:c6:3b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=LAPTOP-EGC0FEF6\\zhang
Chains
May 27, 2026
CN=LAPTOP-EGC0FEF6\\zhang
Subject
CN=LAPTOP-EGC0FEF6\\zhang
Serial Number
3f:9c:68:8b:6a:15:21:bd:41:4c:a5:80:53:73:ba:2c
Issuer
CN=LAPTOP-EGC0FEF6\\zhang
Timespan
Jul 31, 2024 - Jul 31, 2025
Minor OS version
0
Major OS version
4
Entry point
101118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\Projects\Print\PrinterMonitorSvc\PrinterMonitorSvc\obj\Debug\BLMPrinterSVC.pdb
mscoree
_CorExeMain
Name
.text
Size
91KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
print20251118/fuxin_install.bat
- SHA256 55c8cd5a2a6cb30e278478335106c15de5dbc6edcfc968175bed6943e27a99c4
- MD5 03b1bc358b231db8f32bb415d1e352b4
- SHA1 46d3a74136a6a0900ed43b64243946787ccb7207
- SHA512 e12a8361ddcf628a19d1d4a43b61f201275ced9ce6ed23e6ae782a24b89813f193651573b8b447b0cfccbaec534e2529a5eee35cff114bfb454160c3561fe69f
- TLSH T1CA110EA3204109B04B369690177D2117E50840C7BBD4FEE07AB2C4683F7A37269DACDE
- MD5 SHA1 SHA512 TLSH
print20251118/itextsharp.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 ce5a107dad43a4101eeb3fe84ff6d173a6d55f34f0bff725b536366f10e99410
- MD5 b31f086a89de327192a017df159084e6
- SHA1 7cefee1d2d80bc40172b7c9f677d6ccd874c1077
- SHA512 6fb1408dbcc0034cd8580d9a8192bc88e7a510ff42ce2b89eb270891f04d7afc4ae417631f3a5f4bf2aa6b0e165043b8e25c79092414844c56a7726f9c8650bd
- SSDEEP 24576:pCb3LW/oMG2i2FUM9rMk9/clAU2bbCf+CNmD72mQnsHsITqoCZMrPD319jEH3M5y:Ab3LWO0GISBf7N9YqoCZMrPDl9jEH3q
- TLSH T15EC5281C33E99610D52B09BA80A3421392F9F9179BF37B0CE5FC7AAD0D93B90D915663
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2533994
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.5MB
Virtual Size
2.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
print20251118/itextsharp.xml
- SHA256 2efdbef3cedf01a0cac5a8f2d3cc38ee37637ee4244c9d7c780972b6eaf9dc9e
- MD5 b8c06560f1c0366611b7593901b06490
- SHA1 0a89dcfb361936521632bb0bcec073ec68fc777e
- SHA512 094ef2096aa2c5676b88e8c85986c18028031be73587503c32c3ec112f04c8eb1acd089ecc8849a97eb665b63ae449a3ad7b08bed2eced9ede19995a769ca610
- SSDEEP 24576:fGgnIeK+hJoIZy9KzLpM3Pdn4MrIcoxt+0:RnIeK+hJoIZy9KzLpM3Pd4MrIcoxtR
- TLSH T155A5111D36C85E2318B601302E6BB480FA190A776029B75F348C6E071F7A959EBFF65D
- MD5 SHA1 SHA512 SSDEEP TLSH
print20251118/nl/PdfiumViewer.resources.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 6426550dab099f55a5973dff404988a44d80d0970aba3f214faee3d3a3a1944e
- MD5 1f8f1a8e30c82a8ac67b66c48ea4cced
- SHA1 b85bec8c6abcb4fecaba102a53091cfd56a86205
- SHA512 d48b01788fd8a773be098ff949dc1c90dc8768e2b9ed0ca15c8e39633032fb3cff100d35e0204a312bb977bb4649b31ff3740bc8f92dd6d55523af1fa86e8c69
- SSDEEP 48:6xygHJDUoaHmTMwWkcOkVRn+rlA4mlzh4UtCb3LKcXJ2erdJ:K/kMlA/n4UASdK
- TLSH T1DB91661313E40235FAF38B7768B7234126F6B951DE71DA2E4549122E3D227A05EA1F31
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
10526
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
936B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
print20251118/pdfium.dll
- IMPHASH d80a5d7a731e7aeff742442635312fd2
- SHA256 7b5469f3fed2ddb102878457bc486759e029cc5487d429395028a43a15ff1e3b
- MD5 531709324b1f6b5d11b819200b52bc03
- SHA1 3e961b9c827a1655a42caf6d48f6ed2395b0535f
- SHA512 54c38febd64b1da0bf0450917abd8725e770d5097d82c08774a4086402d7cc9942458b3a16231635933d81753156282dc1c7bf118ac9d9f0aef7edc67d671df6
- SSDEEP 196608:4F2cpOcLWMrxLd5VFNOJUlCz8sCN3kb4WztRPJrG9FC4COPWAHmbQ:4FH3dxpfOJUlCz8swUb4WztRPJ6PNjH
- TLSH T1C6E68D56B2B31168C5EBD0788657960BCBB1789507B0BBDF11B10B562F23BF22A7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
9634128
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Projects\Pdfium\repo\pdfium\pdfium.dll.pdb
dbghelp
SymFromAddr
SymSetOptions
SymGetSearchPathW
SymInitialize
SymGetLineFromAddr64
SymSetSearchPathW
kernel32
GetCurrentProcessId
WideCharToMultiByte
TlsGetValue
GetThreadTimes
GetFileType
TlsFree
CreateFileMappingW
GetTempFileNameA
SuspendThread
ResumeThread
GetThreadContext
OpenThread
GetOEMCP
IsValidCodePage
FindNextFileA
GetProcAddress
LoadLibraryW
GetSystemInfo
DeleteFileA
TlsAlloc
CreateFileA
GetTimeZoneInformation
GetTempPathA
UnmapViewOfFile
GetCurrentThreadId
VirtualAlloc
OutputDebugStringA
GetStdHandle
VirtualFree
VirtualProtect
TlsSetValue
SetUnhandledExceptionFilter
RtlCaptureStackBackTrace
GetModuleFileNameW
GetCurrentProcess
GetNativeSystemInfo
QueryPerformanceCounter
GetSystemTimeAsFileTime
QueryPerformanceFrequency
QueryThreadCycleTime
SetThreadPriority
CreateSemaphoreA
ReleaseSemaphore
TryEnterCriticalSection
CreateEventA
ResetEvent
CloseHandle
GetThreadPriority
GetCurrentThread
SetEvent
WaitForSingleObject
Sleep
SetLastError
GetLastError
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableA
SetStdHandle
WriteConsoleW
MapViewOfFile
FindFirstFileExA
FindClose
GetProcessHeap
DeleteFileW
MultiByteToWideChar
CreateFileW
FlushFileBuffers
GetFileSizeEx
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
GetACP
GetWindowsDirectoryA
GetVersionExW
GetSystemDirectoryA
LoadLibraryA
GetLocaleInfoW
GetLocaleInfoA
GetNumberFormatW
GetCurrencyFormatW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetDateFormatW
GetTimeFormatW
FreeLibrary
GetThreadLocale
CreateEventW
GetGeoInfoW
GetUserGeoID
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
CompareStringW
LCMapStringW
GetStringTypeW
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlPcToFileHeader
InterlockedPushEntrySList
InterlockedFlushSList
RaiseException
RtlUnwindEx
LoadLibraryExW
ExitProcess
GetModuleHandleExW
CreateThread
ExitThread
FreeLibraryAndExitThread
HeapAlloc
HeapReAlloc
HeapFree
GetModuleFileNameA
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
HeapSize
GetConsoleCP
GetConsoleMode
ReadConsoleW
shlwapi
PathRemoveFileSpecW
winmm
timeGetTime
advapi32
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
gdi32
WidenPath
StrokePath
StrokeAndFillPath
SetMiterLimit
SelectClipPath
FillPath
EndPath
CloseFigure
GetTextMetricsW
SetStretchBltMode
StretchDIBits
SetPolyFillMode
SetDIBitsToDevice
SaveDC
RestoreDC
LineTo
IntersectClipRect
ExtCreatePen
GetDIBits
GetDeviceCaps
GetClipBox
CreateSolidBrush
CreatePen
CreateFontA
CreateCompatibleBitmap
CreateBitmap
BitBlt
EnumFontFamiliesExA
SelectObject
GetOutlineTextMetricsW
GetFontData
GetCharWidthW
DeleteObject
DeleteDC
CreateFontIndirectA
CreateCompatibleDC
GetObjectW
MoveToEx
PolyBezierTo
GetTextFaceA
GetObjectType
BeginPath
user32
ReleaseDC
GetDC
FillRect
FORM_DoDocumentAAction
FORM_DoDocumentJSAction
FORM_DoDocumentOpenAction
FORM_DoPageAAction
FORM_ForceToKillFocus
FORM_OnAfterLoadPage
FORM_OnBeforeClosePage
FORM_OnChar
FORM_OnKeyDown
FORM_OnKeyUp
FORM_OnLButtonDown
FORM_OnLButtonUp
FORM_OnMouseMove
FPDFAction_GetDest
FPDFAction_GetFilePath
FPDFAction_GetType
FPDFAction_GetURIPath
FPDFAvail_Create
FPDFAvail_Destroy
FPDFAvail_GetDocument
FPDFAvail_GetFirstPageNum
FPDFAvail_IsDocAvail
FPDFAvail_IsFormAvail
FPDFAvail_IsLinearized
FPDFAvail_IsPageAvail
FPDFBitmap_Create
FPDFBitmap_CreateEx
FPDFBitmap_Destroy
FPDFBitmap_FillRect
FPDFBitmap_GetBuffer
FPDFBitmap_GetHeight
FPDFBitmap_GetStride
FPDFBitmap_GetWidth
FPDFBookmark_Find
FPDFBookmark_GetAction
FPDFBookmark_GetDest
FPDFBookmark_GetFirstChild
FPDFBookmark_GetNextSibling
FPDFBookmark_GetTitle
FPDFDOC_ExitFormFillEnvironment
FPDFDOC_InitFormFillEnvironment
FPDFDest_GetPageIndex
FPDFDoc_GetPageMode
FPDFImageObj_LoadJpegFile
FPDFImageObj_SetBitmap
FPDFImageObj_SetMatrix
FPDFLink_CloseWebLinks
FPDFLink_CountQuadPoints
FPDFLink_CountRects
FPDFLink_CountWebLinks
FPDFLink_Enumerate
FPDFLink_GetAction
FPDFLink_GetAnnotRect
FPDFLink_GetDest
FPDFLink_GetLinkAtPoint
FPDFLink_GetLinkZOrderAtPoint
FPDFLink_GetQuadPoints
FPDFLink_GetRect
FPDFLink_GetURL
FPDFLink_LoadWebLinks
FPDFPageObj_HasTransparency
FPDFPageObj_NewImgeObj
FPDFPageObj_Transform
FPDFPageObj_TransformClipPath
FPDFPage_CountObject
FPDFPage_Delete
FPDFPage_Flatten
FPDFPage_FormFieldZOrderAtPoint
FPDFPage_GenerateContent
FPDFPage_GetCropBox
FPDFPage_GetMediaBox
FPDFPage_GetObject
FPDFPage_GetRotation
FPDFPage_HasFormFieldAtPoint
FPDFPage_HasTransparency
FPDFPage_InsertClipPath
FPDFPage_InsertObject
FPDFPage_New
FPDFPage_SetCropBox
FPDFPage_SetMediaBox
FPDFPage_SetRotation
FPDFPage_TransFormWithClip
FPDFPage_TransformAnnots
FPDFText_ClosePage
FPDFText_CountChars
FPDFText_CountRects
FPDFText_FindClose
FPDFText_FindNext
FPDFText_FindPrev
FPDFText_FindStart
FPDFText_GetBoundedText
FPDFText_GetCharBox
FPDFText_GetCharIndexAtPos
FPDFText_GetCharIndexFromTextIndex
FPDFText_GetFontSize
FPDFText_GetRect
FPDFText_GetSchCount
FPDFText_GetSchResultIndex
FPDFText_GetText
FPDFText_GetUnicode
FPDFText_LoadPage
FPDF_AddInstalledFont
FPDF_AddRef
FPDF_CloseDocument
FPDF_ClosePage
FPDF_CopyViewerPreferences
FPDF_CountNamedDests
FPDF_CreateClipPath
FPDF_CreateNewDocument
FPDF_DestroyClipPath
FPDF_DestroyLibrary
FPDF_DeviceToPage
FPDF_FFLDraw
FPDF_GetDefaultSystemFontInfo
FPDF_GetDefaultTTFMap
FPDF_GetDocPermissions
FPDF_GetFileVersion
FPDF_GetLastError
FPDF_GetMetaText
FPDF_GetNamedDest
FPDF_GetNamedDestByName
FPDF_GetPageCount
FPDF_GetPageHeight
FPDF_GetPageSizeByIndex
FPDF_GetPageWidth
FPDF_GetSecurityHandlerRevision
FPDF_ImportPages
FPDF_InitLibrary
FPDF_InitLibraryWithConfig
FPDF_LoadCustomDocument
FPDF_LoadDocument
FPDF_LoadMemDocument
FPDF_LoadPage
FPDF_PageToDevice
FPDF_Release
FPDF_RemoveFormFieldHighlight
FPDF_RenderPage
FPDF_RenderPageBitmap
FPDF_RenderPageBitmap_Start
FPDF_RenderPage_Close
FPDF_RenderPage_Continue
FPDF_SaveAsCopy
FPDF_SaveWithVersion
FPDF_SetFormFieldHighlightAlpha
FPDF_SetFormFieldHighlightColor
FPDF_SetSandBoxPolicy
FPDF_SetSystemFontInfo
FPDF_VIEWERREF_GetDuplex
FPDF_VIEWERREF_GetNumCopies
FPDF_VIEWERREF_GetPrintPageRange
FPDF_VIEWERREF_GetPrintScaling
FPDPage_HasFormFieldAtPoint
FSDK_SetUnSpObjProcessHandler
Name
.text
Size
9.4MB
Virtual Size
9.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
81KB
Virtual Size
136KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
447KB
Virtual Size
446KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gfids
Size
1024B
Virtual Size
852B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
75KB
Virtual Size
75KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=33, id=241, version=40116,
count=175, id=243, version=40116,
count=55, id=242, version=40116,
count=4, id=199, version=41118,
count=10, id=259, version=24123,
count=53, id=261, version=24123,
count=36, id=260, version=24123,
count=109, id=260, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=206, version=65501,
count=15, id=203, version=65501,
count=216, id=1, productName=Unmarked objects,
count=586, id=261, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=468, id=265, version=24210,
count=1, id=256, productName=VS2015 Update 3 [14.0] build 24210, version=24210,
count=1, id=258, productName=VS2015 Update 3 [14.0] build 24210, version=24210,