respocket.zip
- SHA256 71dd00ca6410f7f195289decc5beebaf8651f8b15c9a7879aa595f1f98e84d4b
Overview
overview
7Static
static
3respocket.zip
windows10-2004-x64
1respocket.zip
windows11-ltsc_2024-x64
1loader.exe
windows10-2004-x64
7loader.exe
windows11-ltsc_2024-x64
6x64/Bypass.dll
windows10-2004-x64
1x64/Bypass.dll
windows11-ltsc_2024-x64
1x64/ExtraBypass.dll
windows10-2004-x64
1x64/ExtraBypass.dll
windows11-ltsc_2024-x64
1x64/SQLite...op.dll
windows10-2004-x64
1x64/SQLite...op.dll
windows11-ltsc_2024-x64
1x64/sciter.dll
windows10-2004-x64
1x64/sciter.dll
windows11-ltsc_2024-x64
6x64/wintun.dll
windows10-2004-x64
1x64/wintun.dll
windows11-ltsc_2024-x64
1x86/Bypass.dll
windows10-2004-x64
3x86/Bypass.dll
windows11-ltsc_2024-x64
6x86/ExtraBypass.dll
windows10-2004-x64
3x86/ExtraBypass.dll
windows11-ltsc_2024-x64
3x86/SQLite...op.dll
windows10-2004-x64
3x86/SQLite...op.dll
windows11-ltsc_2024-x64
3x86/sciter.dll
windows10-2004-x64
3x86/sciter.dll
windows11-ltsc_2024-x64
3x86/wintun.dll
windows10-2004-x64
3x86/wintun.dll
windows11-ltsc_2024-x64
3Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
respocket.zip
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
respocket.zip
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
loader.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
x64/Bypass.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
x64/Bypass.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
x64/ExtraBypass.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
x64/ExtraBypass.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
x64/SQLite.Interop.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
x64/SQLite.Interop.dll
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
x64/sciter.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
x64/sciter.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
Behavioral task
behavioral13
Sample
x64/wintun.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
x64/wintun.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
x86/Bypass.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral16
Sample
x86/Bypass.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
15 signatures
150 seconds
Behavioral task
behavioral17
Sample
x86/ExtraBypass.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral18
Sample
x86/ExtraBypass.dll
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral19
Sample
x86/SQLite.Interop.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral20
Sample
x86/SQLite.Interop.dll
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral21
Sample
x86/sciter.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
x86/sciter.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral23
Sample
x86/wintun.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
x86/wintun.dll
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target respocket.zip
- Size 58.0MB
- Sample260701-fatltaev5m
- SHA256 71dd00ca6410f7f195289decc5beebaf8651f8b15c9a7879aa595f1f98e84d4b
- MD5 b37d5146f98183bba538159ffce4b282
- SHA1 3a38640c7ce307509b7bd0a2a26044fb57998eef
- SHA512 65cee42bcd595f7939d6f6b47a54d881a39a7aa38ce289b4b5220fad18c32b32a31f19ced446b5487723fa4ca9b465b183fbf51ff35691fcddee30b900bdc5e3
- SSDEEP 1572864:fqq5tKnLtn0QZd8AokxoYCHaS61TJWo/LuY3MyMMIFL7S4yWS:fqq6nLpzZaLkTbWmRIFJI
- TLSH T1BAD733F1FA5C6DA3B00FA242C7984B09932B346F039654EA040253E795BB7F92F36657
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/loader.exe
File Explorer
-
respocket.zip.zip 58.0MB
-
loader.exe.exe 93.3MB
-
x64/Bypass.dll.dll 8.1MB
-
x64/ExtraBypass.dll.dll 133KB
-
x64/SQLite.Interop.dll.dll 1.5MB
-
x64/sciter.dll.dll 18.6MB
-
x64/wintun.dll.dll 417KB
-
x86/Bypass.dll.dll 6.4MB
-
x86/ExtraBypass.dll.dll 97KB
-
x86/SQLite.Interop.dll.dll 1.2MB
-
x86/sciter.dll.dll 14.7MB
-
x86/wintun.dll.dll 538KB
loader.exe
- IMPHASH fd6f6d07cc33ee9a2b65bda58a07bb94
- SHA256 931e47ab4a793fa346d14b7b599cf9ce49521d3351e80d2098773f7dfa9c1e04
- MD5 5fbd4e15228a889769cb6777e71afe51
- SHA1 e3fe8983beb3b8e9af3a6e0658a9cfc177c4466f
- SHA512 9c961c4bbd9945dfbe45b56f00693748e11fc3a307f3faeb6a3b00845e3213833280119fb501ad435d868707b90672c813b68bf595e4e93ef8b994a489ba45f7
- SSDEEP 1572864:zZa7hmguP2nG0/Vyv7UhgxIabc/x7Awby:zZa7hmguP2nUOnAwby
- TLSH T102286C43A2E751D8F0BBD17497E65323E932BC490B3469EF12944B312F72AE0A779B11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
58584260
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\buildkite-agent\build\build\release\bun-profile.pdb
ntdll
NtAllocateVirtualMemory
NtClose
NtCreateFile
NtCreateNamedPipeFile
NtDeviceIoControlFile
NtFreeVirtualMemory
NtLockFile
NtQueryAttributesFile
NtQueryDirectoryFile
NtQueryInformationFile
NtQueryInformationProcess
NtQueryObject
NtQueryVolumeInformationFile
NtReadFile
NtSetInformationFile
NtWriteFile
RtlAddFunctionTable
RtlCaptureContext
RtlCaptureStackBackTrace
RtlDeleteFunctionTable
RtlEqualUnicodeString
RtlExitUserProcess
RtlGetFullPathName_U
RtlGetSystemTimePrecise
RtlGetVersion
RtlLookupFunctionEntry
RtlNtStatusToDosError
RtlPcToFileHeader
RtlQueryPerformanceCounter
RtlQueryPerformanceFrequency
RtlSetCurrentDirectory_U
RtlUnwind
RtlUnwindEx
RtlUpcaseUnicodeChar
RtlVirtualUnwind
RtlWaitOnAddress
RtlWakeAddressAll
RtlWakeAddressSingle
VerSetConditionMask
userenv
GetUserProfileDirectoryW
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
kernel32
AcquireSRWLockExclusive
AcquireSRWLockShared
AddVectoredExceptionHandler
AreFileApisANSI
AssignProcessToJobObject
BeginUpdateResourceW
CancelIo
CancelIoEx
CancelSynchronousIo
CloseHandle
ClosePseudoConsole
CompareStringEx
CompareStringOrdinal
CompareStringW
ConnectNamedPipe
CopyFileW
CreateDirectoryExW
CreateDirectoryW
CreateEventA
CreateFile2
CreateFileA
CreateFileMappingA
CreateFileMappingW
CreateFileW
CreateHardLinkW
CreateIoCompletionPort
CreateJobObjectA
CreateJobObjectW
CreateMutexA
CreateMutexW
CreateNamedPipeA
CreateNamedPipeW
CreatePipe
CreateProcessA
CreateProcessW
CreatePseudoConsole
CreateSemaphoreA
CreateSymbolicLinkW
CreateThread
DebugBreak
DecodePointer
DeleteCriticalSection
DeleteFileA
DeleteFileW
DeleteProcThreadAttributeList
DeviceIoControl
DiscardVirtualMemory
DuplicateHandle
EncodePointer
EndUpdateResourceW
EnterCriticalSection
EnumResourceLanguagesW
EnumResourceNamesW
EnumSystemLocalesW
ExitProcess
ExitThread
ExpandEnvironmentStringsA
FileTimeToSystemTime
FillConsoleOutputAttribute
FillConsoleOutputCharacterW
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FindResourceExW
FindResourceW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FlushViewOfFile
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
FreeResource
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetComputerNameA
GetConsoleCP
GetConsoleCursorInfo
GetConsoleMode
GetConsoleOutputCP
GetConsoleScreenBufferInfo
GetConsoleTitleW
GetCurrencyFormatEx
GetCurrentDirectoryA
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumber
GetCurrentThread
GetCurrentThreadId
GetCurrentThreadStackLimits
GetDateFormatEx
GetDateFormatW
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetDriveTypeW
GetDynamicTimeZoneInformation
GetEnvironmentStringsW
GetEnvironmentVariableA
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesA
GetFileAttributesExW
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFileSize
GetFileSizeEx
GetFileType
GetFinalPathNameByHandleW
GetFullPathNameA
GetFullPathNameW
GetGeoInfoW
GetLastError
GetLocaleInfoEx
GetLocaleInfoW
GetLongPathNameW
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetNamedPipeClientProcessId
GetNamedPipeHandleStateA
GetNamedPipeServerProcessId
GetNativeSystemInfo
GetNumberFormatEx
GetNumberOfConsoleInputEvents
GetOEMCP
GetOverlappedResult
GetPriorityClass
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetProcessId
GetProcessIoCounters
GetProcessTimes
GetQueuedCompletionStatus
GetQueuedCompletionStatusEx
GetShortPathNameW
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryA
GetSystemDirectoryW
GetSystemInfo
GetSystemTime
GetSystemTimeAsFileTime
GetSystemTimePreciseAsFileTime
GetTempPathA
GetTempPathW
GetThreadContext
GetThreadDescription
GetThreadTimes
GetTickCount
GetTickCount64
GetTimeFormatEx
GetTimeFormatW
GetTimeZoneInformation
GetTimeZoneInformationForYear
GetUserDefaultLCID
GetUserDefaultUILanguage
GetUserGeoID
GlobalLock
GlobalMemoryStatusEx
GlobalSize
GlobalUnlock
HeapAlloc
HeapCompact
HeapCreate
HeapDestroy
HeapFree
HeapQueryInformation
HeapReAlloc
HeapSize
HeapValidate
InitOnceBeginInitialize
InitOnceComplete
InitOnceExecuteOnce
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeProcThreadAttributeList
InitializeSListHead
InitializeSRWLock
InterlockedPushEntrySList
IsDebuggerPresent
IsProcessInJob
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
K32EnumProcessModules
K32GetModuleBaseNameW
K32GetModuleFileNameExA
K32GetProcessMemoryInfo
LCIDToLocaleName
LCMapStringEx
LCMapStringW
LeaveCriticalSection
LoadLibraryA
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalFree
LocaleNameToLCID
LockFile
LockFileEx
LockResource
MapViewOfFile
MoveFileExW
MultiByteToWideChar
NeedCurrentDirectoryForExePathW
OpenProcess
OutputDebugStringA
OutputDebugStringW
PeekNamedPipe
PostQueuedCompletionStatus
QueryMemoryResourceNotification
QueryPerformanceCounter
QueryPerformanceFrequency
QueueUserWorkItem
RaiseException
ReOpenFile
ReadConsoleInputW
ReadConsoleW
ReadDirectoryChangesW
ReadFile
RegisterWaitForSingleObject
ReleaseMutex
ReleaseSRWLockExclusive
ReleaseSRWLockShared
ReleaseSemaphore
RemoveDirectoryW
RemoveVectoredExceptionHandler
ResetEvent
ResizePseudoConsole
ResolveLocaleName
ResumeThread
SearchPathA
SetConsoleCP
SetConsoleCtrlHandler
SetConsoleCursorInfo
SetConsoleCursorPosition
SetConsoleMode
SetConsoleOutputCP
SetConsoleTextAttribute
SetConsoleTitleW
SetCurrentDirectoryW
SetEndOfFile
SetEnvironmentVariableW
SetErrorMode
SetEvent
SetFileAttributesW
SetFileCompletionNotificationModes
SetFileInformationByHandle
SetFilePointer
SetFilePointerEx
SetFileTime
SetHandleInformation
SetInformationJobObject
SetLastError
SetNamedPipeHandleState
SetPriorityClass
SetStdHandle
SetThreadAffinityMask
SetUnhandledExceptionFilter
SizeofResource
Sleep
SleepConditionVariableCS
SleepConditionVariableSRW
SuspendThread
SwitchToThread
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
TryAcquireSRWLockShared
TryEnterCriticalSection
UnhandledExceptionFilter
UnlockFile
UnlockFileEx
UnmapViewOfFile
UnregisterWait
UnregisterWaitEx
UpdateProcThreadAttribute
UpdateResourceW
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
VirtualUnlock
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeW
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
WriteConsoleA
WriteConsoleInputW
WriteConsoleW
WriteFile
lstrlenW
user32
CloseClipboard
DispatchMessageA
GetClipboardData
GetClipboardSequenceNumber
GetMessageA
GetSystemMetrics
IsClipboardFormatAvailable
MapVirtualKeyW
OpenClipboard
RegisterClipboardFormatA
TranslateMessage
shell32
CommandLineToArgvW
SHGetKnownFolderPath
oleaut32
VariantClear
VariantInit
??0Environment@bmalloc@@QEAA@AEBV?$scoped_lock@VMutex@bmalloc@@@std@@@Z
??0EscapableHandleScope@v8@@QEAA@PEAVIsolate@1@@Z
??0EscapableHandleScopeBase@v8@@QEAA@PEAVIsolate@1@@Z
??0HandleScope@v8@@QEAA@PEAVIsolate@1@@Z
??1EscapableHandleScope@v8@@QEAA@XZ
??1HandleScope@v8@@QEAA@XZ
?AddEnvironmentCleanupHook@node@@YAXPEAVIsolate@v8@@P6AXPEAX@Z1@Z
?CheckCast@Array@v8@@CAXPEAVValue@2@@Z
?ContainsOnlyOneByte@String@v8@@QEBA_NXZ
?CreateHandle@HandleScope@v8@@KAPEA_KPEAVIsolate@internal@2@_K@Z
?DisposeGlobal@api_internal@v8@@YAXPEA_K@Z
?EscapeSlot@EscapableHandleScopeBase@v8@@IEAAPEA_KPEA_K@Z
?FromJustIsNothing@api_internal@v8@@YAXXZ
?FullIsFalse@Value@v8@@AEBA_NXZ
?FullIsTrue@Value@v8@@AEBA_NXZ
?Get@Object@v8@@QEAA?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@I@Z
?Get@Object@v8@@QEAA?AV?$MaybeLocal@VValue@v8@@@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@@Z
?GetCurrent@Isolate@v8@@SAPEAV12@XZ
?GetCurrentContext@Isolate@v8@@QEAA?AV?$Local@VContext@v8@@@2@XZ
?GetFunction@FunctionTemplate@v8@@QEAA?AV?$MaybeLocal@VFunction@v8@@@2@V?$Local@VContext@v8@@@2@@Z
?GetFunctionTemplateData@api_internal@v8@@YA?AV?$Local@VValue@v8@@@2@PEAVIsolate@2@V?$Local@VData@v8@@@2@@Z
?GetInternalField@Object@v8@@QEAA?AV?$Local@VData@v8@@@2@H@Z
?GetIsolate@Context@v8@@QEAAPEAVIsolate@2@XZ
?GetName@Function@v8@@QEBA?AV?$Local@VValue@v8@@@2@XZ
?GlobalizeReference@api_internal@v8@@YAPEA_KPEAVIsolate@internal@2@_K@Z
?InternalFieldCount@ObjectTemplate@v8@@QEBAHXZ
?IsArray@Value@v8@@QEBA_NXZ
?IsBigInt@Value@v8@@QEBA_NXZ
?IsBoolean@Value@v8@@QEBA_NXZ
?IsExternal@String@v8@@QEBA_NXZ
?IsExternalOneByte@String@v8@@QEBA_NXZ
?IsExternalTwoByte@String@v8@@QEBA_NXZ
?IsFalse@Value@v8@@QEBA_NXZ
?IsFunction@Value@v8@@QEBA_NXZ
?IsInt32@Value@v8@@QEBA_NXZ
?IsMap@Value@v8@@QEBA_NXZ
?IsNull@Value@v8@@QEBA_NXZ
?IsNullOrUndefined@Value@v8@@QEBA_NXZ
?IsNumber@Value@v8@@QEBA_NXZ
?IsObject@Value@v8@@QEBA_NXZ
?IsOneByte@String@v8@@QEBA_NXZ
?IsString@Value@v8@@QEBA_NXZ
?IsTrue@Value@v8@@QEBA_NXZ
?IsUint32@Value@v8@@QEBA_NXZ
?IsUndefined@Value@v8@@QEBA_NXZ
?IsolateFromNeverReadOnlySpaceObject@internal@v8@@YAPEAVIsolate@12@_K@Z
?Iterate@Array@v8@@QEAA?AV?$Maybe@X@2@V?$Local@VContext@v8@@@2@P6A?AW4CallbackResult@12@IV?$Local@VValue@v8@@@2@PEAX@Z2@Z
?Length@Array@v8@@QEBAIXZ
?Length@String@v8@@QEBAHXZ
?New@Array@v8@@SA?AV?$Local@VArray@v8@@@2@PEAVIsolate@2@H@Z
?New@Array@v8@@SA?AV?$Local@VArray@v8@@@2@PEAVIsolate@2@PEAV?$Local@VValue@v8@@@2@_K@Z
?New@Array@v8@@SA?AV?$MaybeLocal@VArray@v8@@@2@V?$Local@VContext@v8@@@2@_KV?$function@$$A6A?AV?$MaybeLocal@VValue@v8@@@v8@@XZ@std@@@Z
?New@Boolean@v8@@SA?AV?$Local@VBoolean@v8@@@2@PEAVIsolate@2@_N@Z
?New@External@v8@@SA?AV?$Local@VExternal@v8@@@2@PEAVIsolate@2@PEAX@Z
?New@FunctionTemplate@v8@@SA?AV?$Local@VFunctionTemplate@v8@@@2@PEAVIsolate@2@P6AXAEBV?$FunctionCallbackInfo@VValue@v8@@@2@@ZV?$Local@VValue@v8@@@2@V?$Local@VSignature@v8@@@2@HW4ConstructorBehavior@2@W4SideEffectType@2@PEBVCFunction@2@GGG@Z
?New@Number@v8@@SA?AV?$Local@VNumber@v8@@@2@PEAVIsolate@2@N@Z
?New@Object@v8@@SA?AV?$Local@VObject@v8@@@2@PEAVIsolate@2@@Z
?New@ObjectTemplate@v8@@SA?AV?$Local@VObjectTemplate@v8@@@2@PEAVIsolate@2@V?$Local@VFunctionTemplate@v8@@@2@@Z
?NewFromOneByte@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PEAVIsolate@2@PEBEW4NewStringType@2@H@Z
?NewFromUtf8@String@v8@@SA?AV?$MaybeLocal@VString@v8@@@2@PEAVIsolate@2@PEBDW4NewStringType@2@H@Z
?NewInstance@ObjectTemplate@v8@@QEAA?AV?$MaybeLocal@VObject@v8@@@2@V?$Local@VContext@v8@@@2@@Z
?RemoveEnvironmentCleanupHook@node@@YAXPEAVIsolate@v8@@P6AXPEAX@Z1@Z
?Set@Object@v8@@QEAA?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@IV?$Local@VValue@v8@@@2@@Z
?Set@Object@v8@@QEAA?AV?$Maybe@_N@2@V?$Local@VContext@v8@@@2@V?$Local@VValue@v8@@@2@1@Z
?SetInternalField@Object@v8@@QEAAXHV?$Local@VData@v8@@@2@@Z
?SetInternalFieldCount@ObjectTemplate@v8@@QEAAXH@Z
?SetName@Function@v8@@QEAAXV?$Local@VString@v8@@@2@@Z
?SlowGetInternalField@Object@v8@@AEAA?AV?$Local@VData@v8@@@2@H@Z
?StrictEquals@Value@v8@@QEBA_NV?$Local@VValue@v8@@@2@@Z
?ToLocalEmpty@api_internal@v8@@YAXXZ
?TryGetCurrent@Isolate@v8@@SAPEAV12@XZ
?Uint32Value@Value@v8@@QEBA?AV?$Maybe@I@2@V?$Local@VContext@v8@@@2@@Z
?Utf8Length@String@v8@@QEBAHPEAVIsolate@2@@Z
?Value@Boolean@v8@@QEBA_NXZ
?Value@External@v8@@QEBAPEAXXZ
?Value@Number@v8@@QEBANXZ
?WriteUtf8@String@v8@@QEBAHPEAVIsolate@2@PEADHPEAHH@Z
?commitAlignedPhysical@api@bmalloc@@YAXPEAX_KW4HeapKind@2@@Z
?decommitAlignedPhysical@api@bmalloc@@YAXPEAX_KW4HeapKind@2@@Z
?disableScavenger@api@bmalloc@@YAXXZ
?enableMiniMode@api@bmalloc@@YAX_N@Z
?forceEnablePGM@api@bmalloc@@YAXG@Z
?freeLargeVirtual@api@bmalloc@@YAXPEAX_KW4HeapKind@2@@Z
?freeOutOfLine@api@bmalloc@@YAXPEAXW4HeapKind@2@@Z
?isEnabled@api@bmalloc@@YA_NW4HeapKind@2@@Z
?isMTEEnabled@api@bmalloc@@YA_NW4HeapKind@2@@Z
?lockSlowCase@Mutex@bmalloc@@AEAAXXZ
?mallocOutOfLine@api@bmalloc@@YAPEAX_KW4CompactAllocationMode@2@W4HeapKind@2@@Z
?s_memory@Storage@?$StaticPerProcessStorageTraits@VEnvironment@bmalloc@@@bmalloc@@2UMemory@23@A
?s_memory@Storage@?$StaticPerProcessStorageTraits@VSystemHeap@bmalloc@@@bmalloc@@2UMemory@23@A
?s_mutex@Storage@?$StaticPerProcessStorageTraits@VEnvironment@bmalloc@@@bmalloc@@2VMutex@3@A
?s_mutex@Storage@?$StaticPerProcessStorageTraits@VSystemHeap@bmalloc@@@bmalloc@@2VMutex@3@A
?s_object@Storage@?$StaticPerProcessStorageTraits@VEnvironment@bmalloc@@@bmalloc@@2U?$atomic@PEAVEnvironment@bmalloc@@@std@@A
?s_object@Storage@?$StaticPerProcessStorageTraits@VSystemHeap@bmalloc@@@bmalloc@@2U?$atomic@PEAVSystemHeap@bmalloc@@@std@@A
?scavenge@api@bmalloc@@YAXXZ
?scavengeThisThread@api@bmalloc@@YAXXZ
?systemHeapCache@bmalloc@@3PEAVSystemHeap@1@EA
?tryLargeZeroedMemalignVirtual@api@bmalloc@@YAPEAX_K0W4CompactAllocationMode@2@W4HeapKind@2@@Z
dumpBtjsTrace
g_config
icudt73_dat
llhttp_errno_name
llhttp_execute
llhttp_finish
llhttp_get_errno
llhttp_get_error_pos
llhttp_get_error_reason
llhttp_get_http_major
llhttp_get_http_minor
llhttp_get_method
llhttp_get_status_code
llhttp_get_type
llhttp_get_upgrade
llhttp_init
llhttp_message_needs_eof
llhttp_method_name
llhttp_pause
llhttp_reset
llhttp_resume
llhttp_resume_after_upgrade
llhttp_set_error_reason
llhttp_set_lenient_chunked_length
llhttp_set_lenient_data_after_close
llhttp_set_lenient_headers
llhttp_set_lenient_keep_alive
llhttp_set_lenient_optional_cr_before_lf
llhttp_set_lenient_optional_crlf_after_chunk
llhttp_set_lenient_optional_lf_after_cr
llhttp_set_lenient_spaces_after_chunk_size
llhttp_set_lenient_transfer_encoding
llhttp_set_lenient_version
llhttp_settings_init
llhttp_should_keep_alive
llhttp_status_name
napi_acquire_threadsafe_function
napi_add_async_cleanup_hook
napi_add_env_cleanup_hook
napi_add_finalizer
napi_adjust_external_memory
napi_async_destroy
napi_async_init
napi_call_function
napi_call_threadsafe_function
napi_cancel_async_work
napi_check_object_type_tag
napi_close_callback_scope
napi_close_escapable_handle_scope
napi_close_handle_scope
napi_coerce_to_bool
napi_coerce_to_number
napi_coerce_to_object
napi_coerce_to_string
napi_create_array
napi_create_array_with_length
napi_create_arraybuffer
napi_create_async_work
napi_create_bigint_int64
napi_create_bigint_uint64
napi_create_bigint_words
napi_create_buffer
napi_create_buffer_copy
napi_create_dataview
napi_create_date
napi_create_double
napi_create_error
napi_create_external
napi_create_external_arraybuffer
napi_create_external_buffer
napi_create_function
napi_create_int32
napi_create_int64
napi_create_object
napi_create_promise
napi_create_range_error
napi_create_reference
napi_create_string_latin1
napi_create_string_utf16
napi_create_string_utf8
napi_create_symbol
napi_create_threadsafe_function
napi_create_type_error
napi_create_typedarray
napi_create_uint32
napi_define_class
napi_define_properties
napi_delete_async_work
napi_delete_element
napi_delete_property
napi_delete_reference
napi_detach_arraybuffer
napi_escape_handle
napi_fatal_error
napi_fatal_exception
napi_get_all_property_names
napi_get_and_clear_last_exception
napi_get_array_length
napi_get_arraybuffer_info
napi_get_boolean
napi_get_buffer_info
napi_get_cb_info
napi_get_dataview_info
napi_get_date_value
napi_get_element
napi_get_global
napi_get_instance_data
napi_get_last_error_info
napi_get_named_property
napi_get_new_target
napi_get_node_version
napi_get_null
napi_get_property
napi_get_property_names
napi_get_prototype
napi_get_reference_value
napi_get_threadsafe_function_context
napi_get_typedarray_info
napi_get_undefined
napi_get_uv_event_loop
napi_get_value_bigint_int64
napi_get_value_bigint_uint64
napi_get_value_bigint_words
napi_get_value_bool
napi_get_value_double
napi_get_value_external
napi_get_value_int32
napi_get_value_int64
napi_get_value_string_latin1
napi_get_value_string_utf16
napi_get_value_string_utf8
napi_get_value_uint32
napi_get_version
napi_has_element
napi_has_named_property
napi_has_own_property
napi_has_property
napi_instanceof
napi_is_array
napi_is_arraybuffer
napi_is_buffer
napi_is_dataview
napi_is_date
napi_is_detached_arraybuffer
napi_is_error
napi_is_exception_pending
napi_is_promise
napi_is_typedarray
napi_make_callback
napi_module_register
napi_new_instance
napi_object_freeze
napi_object_seal
napi_open_callback_scope
napi_open_escapable_handle_scope
napi_open_handle_scope
napi_queue_async_work
napi_ref_threadsafe_function
napi_reference_ref
napi_reference_unref
napi_reject_deferred
napi_release_threadsafe_function
napi_remove_async_cleanup_hook
napi_remove_env_cleanup_hook
napi_remove_wrap
napi_resolve_deferred
napi_run_script
napi_set_element
napi_set_instance_data
napi_set_named_property
napi_set_property
napi_strict_equals
napi_throw
napi_throw_error
napi_throw_range_error
napi_throw_type_error
napi_type_tag_object
napi_typeof
napi_unref_threadsafe_function
napi_unwrap
napi_wrap
node_api_create_buffer_from_arraybuffer
node_api_create_external_string_latin1
node_api_create_external_string_utf16
node_api_create_property_key_latin1
node_api_create_property_key_utf16
node_api_create_property_key_utf8
node_api_create_syntax_error
node_api_get_module_file_name
node_api_post_finalizer
node_api_symbol_for
node_api_throw_syntax_error
node_module_register
pas_system_heap_free
pas_system_heap_is_enabled
pas_system_heap_malloc
pas_system_heap_malloc_compact
pas_system_heap_memalign
pas_system_heap_memalign_compact
pas_system_heap_realloc
pas_system_heap_realloc_compact
pas_system_heap_should_supplant_bmalloc
uv_accept
uv_addr_ip4_any_
uv_addr_ip6_any_
uv_async_init
uv_async_send
uv_available_parallelism
uv_backend_fd
uv_backend_timeout
uv_barrier_destroy
uv_barrier_init
uv_barrier_wait
uv_buf_init
uv_cancel
uv_chdir
uv_check_init
uv_check_start
uv_check_stop
uv_clock_gettime
uv_close
uv_cond_broadcast
uv_cond_destroy
uv_cond_init
uv_cond_signal
uv_cond_timedwait
uv_cond_wait
uv_cpu_info
uv_cpumask_size
uv_cwd
uv_default_loop
uv_directory_watcher_buffer_size
uv_disable_stdio_inheritance
uv_dlclose
uv_dlerror
uv_dlopen
uv_dlsym
uv_err_name
uv_err_name_r
uv_exepath
uv_fatal_error
uv_fileno
uv_free_cpu_info
uv_free_interface_addresses
uv_freeaddrinfo
uv_fs_access
uv_fs_chmod
uv_fs_chown
uv_fs_close
uv_fs_closedir
uv_fs_copyfile
uv_fs_event_getpath
uv_fs_event_init
uv_fs_event_start
uv_fs_event_stop
uv_fs_fchmod
uv_fs_fchown
uv_fs_fdatasync
uv_fs_fstat
uv_fs_fsync
uv_fs_ftruncate
uv_fs_futime
uv_fs_get_path
uv_fs_get_ptr
uv_fs_get_result
uv_fs_get_statbuf
uv_fs_get_system_error
uv_fs_get_type
uv_fs_lchown
uv_fs_link
uv_fs_lstat
uv_fs_lutime
uv_fs_mkdir
uv_fs_mkdtemp
uv_fs_mkstemp
uv_fs_open
uv_fs_opendir
uv_fs_poll_getpath
uv_fs_poll_init
uv_fs_poll_start
uv_fs_poll_stop
uv_fs_read
uv_fs_readdir
uv_fs_readlink
uv_fs_realpath
uv_fs_rename
uv_fs_req_cleanup
uv_fs_rmdir
uv_fs_scandir
uv_fs_scandir_next
uv_fs_sendfile
uv_fs_stat
uv_fs_statfs
uv_fs_symlink
uv_fs_unlink
uv_fs_utime
uv_fs_write
uv_get_available_memory
uv_get_constrained_memory
uv_get_free_memory
uv_get_osfhandle
uv_get_process_title
uv_get_total_memory
uv_getaddrinfo
uv_getnameinfo
uv_getrusage
uv_gettimeofday
uv_guess_handle
uv_handle_get_data
uv_handle_get_loop
uv_handle_get_type
uv_handle_set_data
uv_handle_size
uv_handle_type_name
uv_has_ref
uv_hrtime
uv_idle_init
uv_idle_start
uv_idle_stop
uv_if_indextoiid
uv_if_indextoname
uv_inet_ntop
uv_inet_pton
uv_interface_addresses
uv_ip4_addr
uv_ip4_name
uv_ip6_addr
uv_ip6_name
uv_ip_name
uv_is_active
uv_is_closing
uv_is_readable
uv_is_writable
uv_key_create
uv_key_delete
uv_key_get
uv_key_set
uv_kill
uv_library_shutdown
uv_listen
uv_loadavg
uv_loop_alive
uv_loop_close
uv_loop_configure
uv_loop_delete
uv_loop_fork
uv_loop_get_data
uv_loop_init
uv_loop_new
uv_loop_set_data
uv_loop_size
uv_metrics_idle_time
uv_metrics_info
uv_mutex_destroy
uv_mutex_init
uv_mutex_init_recursive
uv_mutex_lock
uv_mutex_trylock
uv_mutex_unlock
uv_now
uv_once
uv_open_osfhandle
uv_os_environ
uv_os_free_environ
uv_os_free_group
uv_os_free_passwd
uv_os_get_group
uv_os_get_passwd
uv_os_get_passwd2
uv_os_getenv
uv_os_gethostname
uv_os_getpid
uv_os_getppid
uv_os_getpriority
uv_os_homedir
uv_os_setenv
uv_os_setpriority
uv_os_tmpdir
uv_os_uname
uv_os_unsetenv
uv_pipe
uv_pipe_bind
uv_pipe_bind2
uv_pipe_chmod
uv_pipe_connect
uv_pipe_connect2
uv_pipe_getpeername
uv_pipe_getsockname
uv_pipe_init
uv_pipe_open
uv_pipe_pending_count
uv_pipe_pending_instances
uv_pipe_pending_type
uv_poll_init
uv_poll_init_socket
uv_poll_start
uv_poll_stop
uv_prepare_init
uv_prepare_start
uv_prepare_stop
uv_print_active_handles
uv_print_all_handles
uv_process_get_pid
uv_process_kill
uv_process_tty_read_line_req
uv_process_tty_read_raw_req
uv_queue_work
uv_random
uv_read_start
uv_read_stop
uv_recv_buffer_size
uv_ref
uv_replace_allocator
uv_req_get_data
uv_req_get_type
uv_req_set_data
uv_req_size
uv_req_type_name
uv_resident_set_memory
uv_run
uv_rwlock_destroy
uv_rwlock_init
uv_rwlock_rdlock
uv_rwlock_rdunlock
uv_rwlock_tryrdlock
uv_rwlock_trywrlock
uv_rwlock_wrlock
uv_rwlock_wrunlock
uv_sem_destroy
uv_sem_init
uv_sem_post
uv_sem_trywait
uv_sem_wait
uv_send_buffer_size
uv_set_process_title
uv_setup_args
uv_shutdown
uv_signal_init
uv_signal_start
uv_signal_start_oneshot
uv_signal_stop
uv_simultaneous_server_accepts
uv_sleep
uv_socketpair
uv_spawn
uv_stop
uv_stream_get_write_queue_size
uv_stream_set_blocking
uv_strerror
uv_strerror_r
uv_tcp_bind
uv_tcp_close_reset
uv_tcp_connect
uv_tcp_getpeername
uv_tcp_getsockname
uv_tcp_init
uv_tcp_init_ex
uv_tcp_keepalive
uv_tcp_nodelay
uv_tcp_non_ifs_lsp_ipv4
uv_tcp_non_ifs_lsp_ipv6
uv_tcp_open
uv_tcp_simultaneous_accepts
uv_thread_create
uv_thread_create_ex
uv_thread_equal
uv_thread_getaffinity
uv_thread_getcpu
uv_thread_join
uv_thread_self
uv_thread_setaffinity
uv_timer_again
uv_timer_get_due_in
uv_timer_get_repeat
uv_timer_init
uv_timer_set_repeat
uv_timer_start
uv_timer_stop
uv_translate_sys_error
uv_try_write
uv_try_write2
uv_tty_get_vterm_state
uv_tty_get_winsize
uv_tty_init
uv_tty_reset_mode
uv_tty_set_mode
uv_tty_set_vterm_state
uv_udp_bind
uv_udp_connect
uv_udp_get_send_queue_count
uv_udp_get_send_queue_size
uv_udp_getpeername
uv_udp_getsockname
uv_udp_init
uv_udp_init_ex
uv_udp_open
uv_udp_recv_start
uv_udp_recv_stop
uv_udp_send
uv_udp_set_broadcast
uv_udp_set_membership
uv_udp_set_multicast_interface
uv_udp_set_multicast_loop
uv_udp_set_multicast_ttl
uv_udp_set_source_membership
uv_udp_set_ttl
uv_udp_try_send
uv_udp_using_recvmmsg
uv_unref
uv_update_time
uv_uptime
uv_version
uv_version_string
uv_walk
uv_write
uv_write2
Name
.text
Size
56.3MB
Virtual Size
56.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
35.3MB
Virtual Size
35.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
179KB
Virtual Size
2.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
912KB
Virtual Size
911KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
72KB
Virtual Size
71KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
__DATA,_
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
__DATA,_
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
266KB
Virtual Size
265KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
183KB
Virtual Size
183KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.bun
Size
119KB
Virtual Size
118KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
x64/Bypass.dll
- IMPHASH ef16bea1808a9d8bab5cee0dec89a957
- SHA256 dec01fbb6941fd9a4856f38682a6ed7d90d04e66731e9589a80001b99ea7a6c2
- MD5 113387f3925dfd0cbdd616d55d4b6967
- SHA1 b7da7a3dbfbc5be4ab41affa6c1c5bbb8c2f091a
- SHA512 6ad0288448d7f07f01296ac64d9ed9d248566c0fc875a3a0ecdbaadcd7e8ace0d923f0d2b2ed7ccf69c765a1ec77b58ba3df8a9ec34e91b644fb93c2ad6142a0
- SSDEEP 196608:lSl9ZqKWwVOuqaPg/Kei/v27WKb5+cXuDL+:Ul9ZqKWwVOuq2g/K27WKb5+bL+
- TLSH T141869D1776A600F8E57BC07CC6579A27EB71744A0330ABDB06E082662F67BE05A7F711
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
1f:86:b6:34:02:d7:8a:32:1f:fa:1d:44:50:a7:5f:11:70:81:f7:8f:80:e0:44:26:4a:f3:d7:b4:7a:b1:c3:18
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
Chains
Dec 29, 2025
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
01
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 1, 2004 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
Serial Number
b1:38:e6:66:0d:ca:7c:c3:77:cb:2f:6f:60:27:f6:16
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 13, 2023 - Jan 12, 2026
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Minor OS version
0
Major OS version
6
Entry point
5642948
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\admin\build-dir\CL-VLD-BW\vpn-client\platform\windows\vpnclient\capi\build-x64\AdGuardVpn.pdb
crypt32
CryptMsgClose
CryptQueryObject
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CertOpenSystemStoreA
CertEnumCertificatesInStore
version
VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
iphlpapi
GetIpForwardTable2
FreeMibTable
GetExtendedTcpTable
ConvertInterfaceLuidToGuid
if_indextoname
GetTcpTable
GetTcp6Table
GetPerTcpConnectionEStats
SetPerTcpConnectionEStats
GetPerTcp6ConnectionEStats
SetPerTcp6ConnectionEStats
GetIpInterfaceEntry
SetIpInterfaceEntry
GetAdaptersAddresses
CreateUnicastIpAddressEntry
InitializeUnicastIpAddressEntry
CreateIpForwardEntry2
GetBestRoute2
InitializeIpForwardEntry
ConvertInterfaceLuidToIndex
InitializeIpInterfaceEntry
if_nametoindex
ntdll
RtlIpv6StringToAddressExA
VerSetConditionMask
RtlNtStatusToDosError
RtlPcToFileHeader
RtlUnwindEx
NtWriteFile
RtlUnwind
ws2_32
inet_pton
inet_ntop
bind
htonl
htons
ntohs
socket
WSAIoctl
getaddrinfo
freeaddrinfo
ntohl
connect
setsockopt
shutdown
getsockopt
recv
send
recvfrom
accept
getprotobyname
getservbyname
getprotobynumber
getservbyport
getnameinfo
WSASetLastError
select
WSASendTo
WSARecvFrom
WSASocketW
WSASend
WSARecv
WSAGetOverlappedResult
WSADuplicateSocketW
listen
ioctlsocket
closesocket
WSAStartup
getsockname
getpeername
WSAGetLastError
sendto
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
bcryptprimitives
ProcessPrng
fwpuclnt
FwpmFreeMemory0
FwpmEngineOpen0
FwpmEngineClose0
FwpmTransactionBegin0
FwpmFilterAdd0
FwpmSubLayerAdd0
FwpmGetAppIdFromFileName0
FwpmProviderAdd0
FwpmTransactionAbort0
FwpmTransactionCommit0
kernel32
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
InitOnceComplete
InitOnceBeginInitialize
GetTickCount64
AreFileApisANSI
GetFileAttributesExW
SleepConditionVariableSRW
GetExitCodeThread
GetLocaleInfoEx
RaiseException
TryAcquireSRWLockExclusive
SetEndOfFile
GetCPInfo
UnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
InterlockedPushEntrySList
InterlockedFlushSList
ExitThread
SetUnhandledExceptionFilter
GetModuleFileNameW
LocalAlloc
LocalFree
VerifyVersionInfoW
FormatMessageW
GetModuleHandleW
GetProcAddress
GetModuleHandleA
GetLastError
CloseHandle
SetLastError
SetEvent
ResetEvent
CreateEventW
WaitForMultipleObjects
FreeLibrary
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentProcess
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
PostQueuedCompletionStatus
GetFileType
GetConsoleMode
SetHandleInformation
CreateIoCompletionPort
CancelIo
CreateEventA
SwitchToThread
SetFileCompletionNotificationModes
RegisterWaitForSingleObject
UnregisterWait
SetErrorMode
GetQueuedCompletionStatus
DebugBreak
FormatMessageA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCurrentDirectoryW
GetCurrentProcessId
GetSystemTimeAsFileTime
FileTimeToSystemTime
MultiByteToWideChar
WideCharToMultiByte
FreeLibraryAndExitThread
TryEnterCriticalSection
DeleteCriticalSection
WakeConditionVariable
WakeAllConditionVariable
ReleaseSemaphore
WaitForSingleObject
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleExW
CreateSemaphoreA
SetConsoleCtrlHandler
CreateFileA
CreateFileW
FlushFileBuffers
ReadFile
WriteFile
DuplicateHandle
ConnectNamedPipe
PeekNamedPipe
CreateNamedPipeW
CancelIoEx
CancelSynchronousIo
GetCurrentThread
QueueUserWorkItem
GetNumberOfConsoleInputEvents
ReadConsoleInputW
ReadConsoleW
WriteConsoleW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
SetConsoleTextAttribute
WriteConsoleInputW
TerminateProcess
GetExitCodeProcess
UnregisterWaitEx
LCMapStringW
GetLongPathNameW
ReadDirectoryChangesW
LoadLibraryA
FindClose
FindFirstFileW
FindNextFileW
GetFileInformationByHandle
GetFileSizeEx
GetFullPathNameW
SetFilePointerEx
DeviceIoControl
UnmapViewOfFile
MoveFileExW
GetFileInformationByHandleEx
GetStdHandle
GetStartupInfoW
GetCurrentThreadId
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualQuery
LoadLibraryExW
GetSystemDirectoryA
InitializeCriticalSectionAndSpinCount
GetTickCount
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetCommandLineW
SetFileInformationByHandle
GetProcessHeap
HeapFree
HeapReAlloc
lstrlenW
ReleaseMutex
GetOverlappedResult
FindFirstFileExW
ExitProcess
GetConsoleOutputCP
CreateThread
HeapAlloc
WaitForSingleObjectEx
CreateMutexA
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitOnceExecuteOnce
LoadLibraryW
GetDriveTypeW
GetLogicalDriveStringsW
QueryDosDeviceW
GetVersionExA
GetTimeZoneInformation
SetStdHandle
SystemTimeToTzSpecificLocalTime
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetDateFormatW
GetTimeFormatW
CompareStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
GetNativeSystemInfo
OutputDebugStringW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
HeapSize
EnumSystemLocalesW
user32
TranslateMessage
GetMessageA
DispatchMessageA
MapVirtualKeyW
GetSystemMetrics
advapi32
StartServiceA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
CreateServiceW
CloseServiceHandle
RegSetValueExA
SystemFunction036
RegSetKeyValueA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
wintrust
WinVerifyTrust
locations_pinger_runner_create
locations_pinger_runner_free
locations_pinger_runner_run
sockaddr_from_str_out
tls_free_serialized_cert
tls_free_serialized_chain
tls_get_cert
tls_get_chain
tls_serialize_cert
tls_serialize_cert_chain
vpn_abandon_endpoint
vpn_address_array_destroy_contents
vpn_backend_client_create
vpn_backend_client_destroy
vpn_backend_client_get_authorization_link
vpn_backend_client_make_request
vpn_backend_client_notify_network_change
vpn_backend_client_response_free_content
vpn_backend_client_string_free
vpn_backend_get_tds_base_link
vpn_close
vpn_cm_close
vpn_cm_get_endpoint
vpn_cm_open
vpn_cm_start
vpn_cm_stop
vpn_complete_connect_request
vpn_connect
vpn_create_netfilter_listener
vpn_create_os_tunnel_settings
vpn_create_socks_listener
vpn_create_tun_listener
vpn_dns_stamp_free
vpn_dns_stamp_from_str
vpn_dns_stamp_prettier_url
vpn_dns_stamp_pretty_url
vpn_dns_stamp_to_str
vpn_force_disconnect
vpn_force_reconnect
vpn_get_capi_version_hash
vpn_get_event_loop
vpn_get_socks_listener_address
vpn_handler_profiling_enabled
vpn_handler_profiling_set_enabled
vpn_handler_profiling_threshold_ns
vpn_listen
vpn_listener_config_clone
vpn_listener_config_destroy
vpn_network_manager_notify_app_request_domain
vpn_network_manager_set_outbound_interface
vpn_notify_network_change
vpn_open
vpn_os_tunnel_settings_clone
vpn_os_tunnel_settings_defaults
vpn_os_tunnel_settings_destroy
vpn_post_quantum_group_enabled
vpn_post_quantum_group_set_enabled
vpn_request_endpoint_connection_stats
vpn_reset_connections
vpn_stop
vpn_string_free
vpn_suggest_tunnel_included_routes
vpn_update_exclusions
vpn_validate_dns_upstream
vpn_validate_exclusion
vpn_win_detect_active_if
vpn_win_socket_protect
vpn_win_tunnel_create
vpn_win_tunnel_destroy
vpn_win_tunnel_settings_clone
vpn_win_tunnel_settings_defaults
vpn_win_tunnel_settings_destroy
vpn_windows_close
vpn_windows_crash
vpn_windows_disable_set_unhandled_exception_filter
vpn_windows_enable_set_unhandled_exception_filter
vpn_windows_get_client_version
vpn_windows_listen
vpn_windows_notify_dns_change
vpn_windows_open
vpn_windows_set_log_callback
vpn_windows_set_log_level
Name
.text
Size
5.7MB
Virtual Size
5.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.0MB
Virtual Size
2.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
122KB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
251KB
Virtual Size
251KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourc
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
24B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
31KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=13, id=259, version=30795,
count=215, id=261, version=30795,
count=8, id=253, version=35207,
count=15, id=260, version=35207,
count=12, id=259, version=35207,
count=94, id=261, version=35207,
count=6, id=260, version=32537,
count=1, id=261, version=32822,
count=92, productName=Unmarked objects (old),
count=23, id=260, version=30795,
count=10, id=260, version=32822,
count=80, id=261, version=34435,
count=1, id=261, version=32537,
count=419, id=260, version=34435,
count=25, id=257, version=30795,
count=423, id=1, productName=Unmarked objects,
count=36, id=260, version=35217,
count=162, id=261, version=35217,
count=1, id=256, version=35217,
count=1, id=255, version=35217,
count=1, id=151,
count=1, id=258, version=35217,
x64/ExtraBypass.dll
- IMPHASH d8c6ac4236cba259b33a6fd5eb10d558
- SHA256 daa3e138c21b572cb7955ee35f2fb1398b47313837c73f5999a385e1957bc392
- MD5 f808357eb75ce997e02ed7c936f33b81
- SHA1 94eb0afd7193de15f94d5788a8b56e65933b2683
- SHA512 ee3b8a35183a29edf1f699bcb00463fae1d6ce0227616b90ef13979f18025ed26f4441055e872b625e87fcedfd35951467d104fab97856190a77c62d5178f280
- SSDEEP 3072:y/Mc90jGyW2CAqrC3Q8S+vEyBUB+5vnA8wvsl:yUO0jGE9qrwQ2NVpevsl
- TLSH T151D36C47B7B410BFE4778274C8D30A12D7B6B8251B609B9F07A046592F237E19D3EB61
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
5d:4d:26:f8:8b:24:1a:0d:d2:b5:13:00:0d:ee:07:5c:94:be:f8:e4:d8:2f:c0:4d:73:38:56:d1:8f:43:9e:46
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
Chains
Aug 11, 2025
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
Serial Number
b1:38:e6:66:0d:ca:7c:c3:77:cb:2f:6f:60:27:f6:16
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 13, 2023 - Jan 12, 2026
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
01
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 1, 2004 - Dec 31, 2028
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Minor OS version
0
Major OS version
6
Entry point
8704
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BWU-JOB1\AdGuard.Commons\build\bin\Release\x64\AGIpHelperClose.pdb
kernel32
GetNamedPipeInfo
OpenProcess
GetFileType
GetCurrentProcess
CloseHandle
WriteConsoleW
GetModuleHandleW
GetProcAddress
DuplicateHandle
LoadLibraryA
CreateFileW
SetFilePointerEx
GetConsoleMode
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
MultiByteToWideChar
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
DeleteFileW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
advapi32
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
ws2_32
getpeername
getsockopt
WSACleanup
WSAStartup
WSAGetLastError
shutdown
CloseSocketsByPid
SetTcpEntry6
Name
.text
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
41KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=29395,
count=135, id=261, version=29395,
count=10, id=260, version=29395,
count=9, id=259, version=34321,
count=14, id=260, version=34321,
count=37, id=261, version=34321,
count=7, id=257, version=29395,
count=102, id=1, productName=Unmarked objects,
count=4, id=265, version=34435,
count=1, id=256, version=34435,
count=1, id=255, version=34435,
count=1, id=151,
count=1, id=258, version=34435,
x64/SQLite.Interop.dll
- IMPHASH 9c208621f87838d81aaabd3b0bd652ba
- SHA256 93b35c2c65f7eb739f8122ca09b58d0bf8a4653f772281c8c0be450146d32ba2
- MD5 5389512ffe243a7becec1d9fd58c84d0
- SHA1 580b65e88c4e0e4b91fbd13d50d28e858851ae23
- SHA512 ed42d5acb77db2736803c5d118cd0a1335e0396bbb848573d8295809621fc9bfb0b1faff7c085f8b4f5a08fad62e1330502baffba235c2431fbd655124738e91
- SSDEEP 24576:5CYA/V0MQ/AOv4FIljfL0lCNmjMO0qqjh3aF9dfOZph7/akDAz/PrZU+L0/mZfo9:ZA8IBFIljfL0lCNmjujRaF9dg7/YS+E/
- TLSH T140657C4BA2B501D8D6ABC17DCA175607FB7274051360ABEF57A08BA62F13FE2167E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
42:5e:85:ac:39:46:8d:0f:9c:2a:c3:e3:72:87:84:18:bf:5a:95:e7:b8:bb:79:8e:d2:68:09:f1:08:f6:30:85
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
Chains
May 21, 2024
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
Serial Number
b1:38:e6:66:0d:ca:7c:c3:77:cb:2f:6f:60:27:f6:16
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 13, 2023 - Jan 12, 2026
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
11248
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet\bin\2012\x64\ReleaseNativeOnlyStatic\SQLite.Interop.pdb
kernel32
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
GetFileAttributesA
LeaveCriticalSection
HeapCreate
HeapValidate
MapViewOfFile
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
OutputDebugStringA
GetCurrentThreadId
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
TryEnterCriticalSection
SetFilePointer
HeapCompact
CreateMutexW
GetFileSize
CreateFileA
HeapReAlloc
GetFullPathNameA
GetFileAttributesW
GetFullPathNameW
EncodePointer
DecodePointer
CreateThread
ExitThread
LoadLibraryExW
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetTimeZoneInformation
SetLastError
ExitProcess
GetModuleHandleExW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStdHandle
GetFileType
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleFileNameW
GetStringTypeW
CompareStringW
LCMapStringW
SetEnvironmentVariableA
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
RaiseException
advapi32
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptDuplicateKey
CryptDeriveKey
CryptAcquireContextW
CryptHashData
interop_compileoption_get
interop_compileoption_used
interop_libversion
interop_sourceid
sqlite3_activate_see
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_finish_interop
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_double_interop
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_int64_interop
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_parameter_name_interop
sqlite3_bind_pointer
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_bind_zeroblob64
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_close_interop
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_changes_interop
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_interop
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_database_name16_interop
sqlite3_column_database_name_interop
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_decltype16_interop
sqlite3_column_decltype_interop
sqlite3_column_double
sqlite3_column_double_interop
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_int64_interop
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_name16_interop
sqlite3_column_name_interop
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_origin_name16_interop
sqlite3_column_origin_name_interop
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_table_name16_interop
sqlite3_column_table_name_interop
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_text16_interop
sqlite3_column_text_interop
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_collcompare_interop
sqlite3_context_collseq_interop
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_disposable_module
sqlite3_create_disposable_module_interop
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_interop
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_cursor_rowid_interop
sqlite3_data_count
sqlite3_data_directory
sqlite3_db_cacheflush
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_dispose_module
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errmsg_interop
sqlite3_errstr
sqlite3_exec
sqlite3_expanded_sql
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_finalize_interop
sqlite3_free
sqlite3_free_table
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_index_column_info_interop
sqlite3_initialize
sqlite3_interrupt
sqlite3_json_init
sqlite3_key
sqlite3_key_v2
sqlite3_last_insert_rowid
sqlite3_last_insert_rowid_interop
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_malloc_size_interop
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_highwater_interop
sqlite3_memory_used
sqlite3_memory_used_interop
sqlite3_mprintf
sqlite3_msize
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open16_interop
sqlite3_open_interop
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_percentile_init
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_interop
sqlite3_prepare16_v2
sqlite3_prepare16_v3
sqlite3_prepare_interop
sqlite3_prepare_v2
sqlite3_prepare_v3
sqlite3_preupdate_count
sqlite3_preupdate_depth
sqlite3_preupdate_hook
sqlite3_preupdate_new
sqlite3_preupdate_old
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_regexp_init
sqlite3_rekey
sqlite3_rekey_v2
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_reset_interop
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_double_interop
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_int64_interop
sqlite3_result_null
sqlite3_result_pointer
sqlite3_result_subtype
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_result_zeroblob64
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_set_last_insert_rowid
sqlite3_sha_init
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_status64
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_strglob
sqlite3_stricmp
sqlite3_strlike
sqlite3_strnicmp
sqlite3_system_errno
sqlite3_table_column_metadata
sqlite3_table_column_metadata_interop
sqlite3_table_cursor_interop
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_totype_init
sqlite3_trace
sqlite3_trace_v2
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_double_interop
sqlite3_value_dup
sqlite3_value_free
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_int64_interop
sqlite3_value_numeric_type
sqlite3_value_pointer
sqlite3_value_subtype
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16_interop
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_text_interop
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_config
sqlite3_vtab_on_conflict
sqlite3_vtshim_init
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_compact_heap
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_mbcs_to_utf8_v2
sqlite3_win32_reset_heap
sqlite3_win32_set_directory
sqlite3_win32_sleep
sqlite3_win32_unicode_to_utf8
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_utf8_to_mbcs_v2
sqlite3_win32_utf8_to_unicode
sqlite3_win32_write_debug
sqlite3changegroup_add
sqlite3changegroup_add_strm
sqlite3changegroup_delete
sqlite3changegroup_new
sqlite3changegroup_output
sqlite3changegroup_output_strm
sqlite3changeset_apply
sqlite3changeset_apply_strm
sqlite3changeset_concat
sqlite3changeset_concat_strm
sqlite3changeset_conflict
sqlite3changeset_finalize
sqlite3changeset_fk_conflicts
sqlite3changeset_invert
sqlite3changeset_invert_strm
sqlite3changeset_new
sqlite3changeset_next
sqlite3changeset_old
sqlite3changeset_op
sqlite3changeset_pk
sqlite3changeset_start
sqlite3changeset_start_strm
sqlite3session_attach
sqlite3session_changeset
sqlite3session_changeset_strm
sqlite3session_create
sqlite3session_delete
sqlite3session_diff
sqlite3session_enable
sqlite3session_indirect
sqlite3session_isempty
sqlite3session_patchset
sqlite3session_patchset_strm
sqlite3session_table_filter
Name
.text
Size
1.2MB
Virtual Size
1.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
225KB
Virtual Size
225KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
64KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=207, version=50929,
count=134, id=206, version=50929,
count=22, id=205, version=50929,
count=136, id=1, productName=Unmarked objects,
count=5, id=185, version=30716,
count=1, id=210, version=61219,
count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
x64/sciter.dll
- IMPHASH 067a5929adc15f53767de2bfd6e9611f
- SHA256 77e82cdf92f908a75efc0aa28a5b92ba36837ca309972343930f96c00dab8f00
- MD5 56aedce490069d72f6219d3ba0728168
- SHA1 a6399778ee997c73973be2f188fb3f05bb7be62e
- SHA512 ad648eebb456909edba00c9a795bf8575e3b30671302773831d0cba115d3f20dd55bc72b3d9cfa55d2e798c40d94d1c203aaa9b97387a751fcc967803b78fd9d
- SSDEEP 196608:zYyN5GzA15auSsLGaQz9G2n3VMBvkpYRNiNxK+:zYq5Gc1crsLGaQ82n3eBpRNiNxd
- TLSH T18B179D57B2A480A9C4AAC074CA57DE17E7B2BC590270C35F21F466EA9F377706E6E310
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
bf:0c:ff:41:93:1c:30:e9:33:30:ba:47:cd:29:95:b6:2c:44:b5:87:94:a2:7e:16:ca:ea:0c:f2:c4:22:74:86
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
Chains
Nov 10, 2025
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
01
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 1, 2004 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
Serial Number
b1:38:e6:66:0d:ca:7c:c3:77:cb:2f:6f:60:27:f6:16
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 13, 2023 - Jan 12, 2026
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Minor OS version
0
Major OS version
6
Entry point
12909216
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\sciter\work\sdk\bin\windows\x64\sciter.pdb
userenv
GetUserProfileDirectoryW
shlwapi
UrlCreateFromPathW
PathIsRelativeW
PathCreateFromUrlW
winmm
timeSetEvent
timeEndPeriod
timeKillEvent
timeGetTime
timeBeginPeriod
comctl32
ImageList_Destroy
ImageList_DrawEx
ImageList_GetIconSize
oleacc
LresultFromObject
AccessibleObjectFromWindow
usp10
ScriptItemize
ScriptFreeCache
ScriptShape
ws2_32
bind
WSARecvFrom
WSAIoctl
FreeAddrInfoW
setsockopt
GetAddrInfoW
WSASendTo
select
WSAStartup
WSASetLastError
ntohs
getaddrinfo
getsockopt
closesocket
ioctlsocket
WSARecv
connect
socket
getsockname
getpeername
freeaddrinfo
WSAGetLastError
htonl
ntohl
WSASocketW
listen
shutdown
htons
WSASend
wininet
HttpSendRequestA
InternetConnectA
InternetCloseHandle
InternetOpenA
InternetSetOptionW
HttpQueryInfoW
InternetReadFile
HttpQueryInfoA
InternetErrorDlg
HttpOpenRequestA
InternetQueryOptionW
imm32
ImmIsIME
ImmNotifyIME
ImmAssociateContextEx
ImmSetCandidateWindow
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
kernel32
GetTempPathA
RtlAddFunctionTable
GetCommandLineA
GetModuleHandleExA
HeapQueryInformation
RtlDeleteFunctionTable
GetSystemDirectoryA
GetCommandLineW
GetModuleFileNameA
MultiByteToWideChar
Sleep
QueryPerformanceFrequency
QueryPerformanceCounter
SleepConditionVariableCS
TlsSetValue
EnterCriticalSection
GetCurrentProcess
ReleaseSemaphore
TryAcquireSRWLockExclusive
WakeAllConditionVariable
WakeConditionVariable
LeaveCriticalSection
InitializeCriticalSection
InitializeConditionVariable
WaitForSingleObject
ResumeThread
DuplicateHandle
CreateEventW
GetLastError
ReleaseSRWLockExclusive
SetEvent
GetCurrentThread
AcquireSRWLockExclusive
TlsAlloc
CloseHandle
GetNativeSystemInfo
DeleteCriticalSection
CreateSemaphoreW
TlsGetValue
TlsFree
GetStartupInfoW
GlobalAlloc
GlobalFree
GlobalLock
SetThreadExecutionState
GetModuleHandleW
GlobalUnlock
CompareStringW
GetSystemDefaultLCID
GetFullPathNameW
GetModuleFileNameW
GetLocaleInfoW
GetUserDefaultLCID
VerSetConditionMask
GetComputerNameW
WideCharToMultiByte
VerifyVersionInfoW
FindFirstFileW
FindNextFileW
FindClose
SetFilePointer
SetEndOfFile
CreateFileW
UnmapViewOfFile
FlushViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFile
GetTimeZoneInformation
SystemTimeToFileTime
GetSystemTime
GetProcAddress
FreeLibrary
LoadLibraryExW
MulDiv
SetLastError
SetEnvironmentVariableW
GetConsoleTitleW
GetEnvironmentVariableW
GetTempPathW
GetVersionExW
FreeEnvironmentStringsW
GetSystemInfo
GetCurrentDirectoryW
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
OutputDebugStringW
LocalFree
FormatMessageA
DebugBreak
GetFileAttributesW
GetModuleHandleExW
FormatMessageW
GetConsoleMode
GetFileType
SetErrorMode
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
CancelIo
SetHandleInformation
RegisterWaitForSingleObject
UnregisterWait
CancelIoEx
SwitchToThread
SetFileCompletionNotificationModes
ReadFile
SetNamedPipeHandleState
CreateNamedPipeA
WriteFile
CreateNamedPipeW
PeekNamedPipe
QueueUserWorkItem
CancelSynchronousIo
CreateFileA
GetNamedPipeHandleStateW
WaitNamedPipeW
ConnectNamedPipe
FlushFileBuffers
OutputDebugStringA
GetCPInfo
GetModuleHandleA
LoadLibraryA
GetNumberFormatW
GetCurrencyFormatW
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
GlobalSize
GetLongPathNameW
GetShortPathNameW
ReadDirectoryChangesW
SetInformationJobObject
AssignProcessToJobObject
TerminateProcess
CreateJobObjectW
UnregisterWaitEx
LCMapStringW
CreateProcessW
GetExitCodeProcess
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetConsoleMode
GetConsoleCursorInfo
SetConsoleCursorInfo
FillConsoleOutputCharacterW
ReadConsoleInputW
ReadConsoleW
ResetEvent
WriteConsoleInputW
FillConsoleOutputAttribute
WriteConsoleW
GetNumberOfConsoleInputEvents
SetConsoleCursorPosition
CreateDirectoryW
GetFileInformationByHandleEx
GetFileSizeEx
GetDiskFreeSpaceW
DeviceIoControl
RemoveDirectoryW
SetFileTime
ReOpenFile
CreateHardLinkW
GetFileInformationByHandle
SetFilePointerEx
MoveFileExW
CopyFileW
CreateSymbolicLinkW
InitializeCriticalSectionEx
DecodePointer
GetStdHandle
HeapFree
SetThreadPriority
HeapReAlloc
CreateThread
HeapAlloc
GetProcessHeap
LoadLibraryW
VirtualFree
VirtualAlloc
WaitForMultipleObjects
GetCurrentThreadId
lstrcmpW
SetDllDirectoryW
VirtualProtect
GetThreadPriority
GetTickCount
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
WaitForSingleObjectEx
GetExitCodeThread
GetTickCount64
EncodePointer
LCMapStringEx
GetStringTypeW
RaiseException
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
RtlUnwind
InitializeCriticalSectionAndSpinCount
HeapSize
ExitThread
FreeLibraryAndExitThread
ExitProcess
SetStdHandle
GetConsoleOutputCP
GetFileAttributesExW
SetFileAttributesW
GetDriveTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
IsValidLocale
EnumSystemLocalesW
IsValidCodePage
GetACP
GetOEMCP
FindFirstFileExW
user32
GetParent
KillTimer
SetRect
IsZoomed
GetClientRect
SetWindowLongW
FlashWindowEx
SetCursor
SetCapture
ClipCursor
LoadCursorW
LoadIconW
TranslateMessage
RegisterRawInputDevices
SetPropW
BringWindowToTop
SetFocus
SetLayeredWindowAttributes
GetMessageTime
MoveWindow
TrackMouseEvent
GetRawInputData
SetWindowPlacement
PeekMessageW
GetLayeredWindowAttributes
ClientToScreen
CreateIconIndirect
GetMonitorInfoW
DestroyIcon
SetTimer
DispatchMessageW
OffsetRect
GetAsyncKeyState
ShowWindow
GetActiveWindow
GetClassLongPtrW
GetWindowPlacement
WindowFromPoint
RegisterClassExW
GetWindowLongW
InvalidateRect
PtInRect
RemovePropW
SendMessageW
ScreenToClient
CreateWindowExW
MonitorFromWindow
GetPropW
SetWindowPos
IsWindowVisible
GetDC
DestroyWindow
MapVirtualKeyW
PostMessageW
GetKeyState
DefWindowProcW
GetDoubleClickTime
MessageBeep
DestroyCaret
GetKeyboardLayout
CreateCaret
SetCaretPos
UnregisterDeviceNotification
ToUnicode
RegisterDeviceNotificationW
UnregisterClassW
EnumDisplaySettingsW
EnumDisplayDevicesW
EnumDisplaySettingsExW
EnumDisplayMonitors
ChangeDisplaySettingsExW
GetWindowTextW
GetDesktopWindow
IsWindow
NotifyWinEvent
GetRawInputDeviceList
GetWindowThreadProcessId
GetClipboardSequenceNumber
RegisterClipboardFormatW
GetMessageW
PostThreadMessageW
GetQueueStatus
IsIconic
SetCursorPos
UpdateWindow
ReleaseCapture
SetForegroundWindow
SetWindowTextW
ReleaseDC
GetCursorPos
BeginPaint
EndPaint
EnableWindow
DeferWindowPos
AdjustWindowRectEx
LoadImageW
GetWindowRect
GetSystemMetrics
BeginDeferWindowPos
MapWindowPoints
GetSysColor
EndDeferWindowPos
SystemParametersInfoW
WaitMessage
RegisterWindowMessageW
WindowFromDC
MsgWaitForMultipleObjects
GetRawInputDeviceInfoA
gdi32
SelectObject
DeleteDC
DeleteObject
CreateBitmap
GetDeviceGammaRamp
GetDeviceCaps
DescribePixelFormat
ChoosePixelFormat
SwapBuffers
SetPixelFormat
GetTextFaceW
CreateCompatibleDC
CreateDCW
CreateRectRgn
SetDeviceGammaRamp
AddFontMemResourceEx
GetFontUnicodeRanges
EnumFontFamiliesExW
SetGraphicsMode
StretchDIBits
GdiFlush
GetTextMetricsW
SetTextColor
GetFontData
SetBkMode
GetTextExtentPointI
GetGlyphIndicesW
GetCharABCWidthsW
GetGlyphOutlineW
RemoveFontMemResourceEx
CreateFontIndirectW
GetOutlineTextMetricsW
SetTextAlign
ExtTextOutW
SetWorldTransform
CreateDIBSection
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetUserNameW
OpenProcessToken
SystemFunction036
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
shell32
SHGetFileInfoW
ord727
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetSpecialFolderPathW
DragQueryFileW
ord74
Shell_NotifyIconW
ShellExecuteExW
ole32
CoUninitialize
CoFreeUnusedLibraries
CoTaskMemAlloc
CoInitialize
RevokeDragDrop
OleGetClipboard
CoCreateInstance
OleSetClipboard
DoDragDrop
ReleaseStgMedium
OleInitialize
OleUninitialize
CoCreateGuid
CoTaskMemFree
RegisterDragDrop
oleaut32
SysFreeString
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreateVector
SysAllocStringLen
dxgi
CreateDXGIFactory1
SciterAPI
Name
.text
Size
13.1MB
Virtual Size
13.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4.1MB
Virtual Size
4.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
542KB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
460KB
Virtual Size
460KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
269KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
172KB
Virtual Size
171KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=39, id=259, version=33136,
count=14, id=253, version=34321,
count=12, id=259, version=34321,
count=17, id=260, version=34321,
count=95, id=261, version=34321,
count=121, id=260, version=33136,
count=1, id=262, version=33136,
count=229, id=261, version=33136,
count=41, id=257, version=33136,
count=549, id=1, productName=Unmarked objects,
count=1843, id=265, version=34808,
count=1, id=256, version=34808,
count=1, id=255, version=34808,
count=1, id=151,
count=1, id=258, version=34808,
x64/wintun.dll
- IMPHASH 01ce5951b7d0dcca222159a28511a055
- SHA256 e5da8447dc2c320edc0fc52fa01885c103de8c118481f683643cacc3220dafce
- MD5 e861eb5789c50997d9476a6172d1c269
- SHA1 647eb6588b149efe2477fd192c8cab74d018d8ef
- SHA512 d8b49a6834c1ea5d73fee6979c59def18900c86d598ea900ab741ce71eefdaaadb4862afefa14e6cc093007eae5d4325857633549f1ade555baa0344b18e6112
- SSDEEP 6144:uNsLgQtz9nDZL4tFDjiaOE1DfsnyDQhWmnPIt:iggQh9nD2tFviW4/Qt
- TLSH T1E2947D8273E81C96E9F3CB3889638901EB3779544770CADF1261826DDE6B7D09E34B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d8:b2:c9:fd:88:91:f9:1c:30:2d:36:f9:b1:b3:95:7d:da:2e:ea:b0:e7:6f:7a:16:e7:90:01:98:4b:e8:2f:39
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=4227913,CN=WireGuard LLC,O=WireGuard LLC,L=Boulder,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Oct 17, 2021
SERIALNUMBER=4227913,CN=WireGuard LLC,O=WireGuard LLC,L=Boulder,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=4227913,CN=WireGuard LLC,O=WireGuard LLC,L=Boulder,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
06:63:d5:fc:a7:28:88:2f:36:ff:1b:df:5d:85:f0:ba
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2018 - Dec 14, 2021
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
0
Major OS version
6
Entry point
35968
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Jason A. Donenfeld\Projects\wintun\Release\amd64\wintun.pdb
kernel32
HeapCreate
GetCurrentProcess
LoadLibraryExA
CloseHandle
HeapDestroy
GetProcAddress
LocalFree
GetModuleHandleW
IsWow64Process
HeapFree
SetLastError
WaitForSingleObject
CreateFileW
OpenProcess
QueueUserWorkItem
CreateEventW
Sleep
GetLastError
SetEvent
HeapAlloc
GetCurrentProcessId
GetProcessTimes
RemoveDirectoryW
DeleteFileW
FormatMessageW
EnterCriticalSection
CreatePrivateNamespaceW
OpenPrivateNamespaceW
LeaveCriticalSection
InitializeCriticalSection
CreateBoundaryDescriptorW
CreateMutexW
ReleaseMutex
ClosePrivateNamespace
AddSIDToBoundaryDescriptor
DeleteCriticalSection
DeleteBoundaryDescriptor
ExpandEnvironmentStringsW
HeapReAlloc
CreateDirectoryW
SizeofResource
WriteFile
LockResource
LoadResource
FindResourceW
GetWindowsDirectoryW
VirtualFree
DeviceIoControl
VirtualAlloc
InitializeCriticalSectionAndSpinCount
ReadFile
SetHandleInformation
CreatePipe
GetExitCodeThread
CreateThread
CreateProcessW
WriteConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapSize
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
InterlockedFlushSList
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RtlPcToFileHeader
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
ntdll
NtQuerySystemInformation
RtlNtStatusToDosError
RtlGetNtVersionNumbers
NtQueryKey
NtQuerySystemTime
WintunAllocateSendPacket
WintunCloseAdapter
WintunCreateAdapter
WintunDeleteDriver
WintunEndSession
WintunGetAdapterLUID
WintunGetReadWaitEvent
WintunGetRunningDriverVersion
WintunOpenAdapter
WintunReceivePacket
WintunReleaseReceivePacket
WintunSendPacket
WintunSetLogger
WintunStartSession
Name
.text
Size
137KB
Virtual Size
137KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
62KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
1024B
Virtual Size
536B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
191KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=5, id=259, version=29395,
count=143, id=261, version=29395,
count=14, id=260, version=30034,
count=9, id=259, version=30034,
count=33, id=261, version=30034,
count=12, id=260, version=29395,
count=2, id=257, version=29395,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=191, id=1, productName=Unmarked objects,
count=9, id=264, version=30136,
count=1, id=256, productName=VS2019 v16.11.5 build 30136, version=30136,
count=1, id=255, productName=VS2019 v16.11.5 build 30136, version=30136,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.11.5 build 30136, version=30136,
x86/Bypass.dll
- IMPHASH dcb6feba79badd90a6b6b31ef76c48af
- SHA256 2a29d2d9378a44e6ce051f072bbc79aa0ec6cfc6d4594499c3f60dce007f1382
- MD5 12139240c449d58185295311b9ca1bd3
- SHA1 233a49c4e8080d114df0a8eff6c61027fb2999b5
- SHA512 b1622be018f89ba35db49625ae3c9570fb4840b35c326c519e1b08624f40c368247eec8fff12afb4c116aa940ad398690e57de66ce9ed5616e53b7639805043a
- SSDEEP 98304:ldjcdo1enJIVtecCJn+6z3WC4JySwChtBW6oG+wh1+5bUY7:Wije1Jn+6zGBJyQhUGHQF
- TLSH T1A466AE12B903C032E4DB01B1E1AEEBBE4A6C4630132594D797D05D7AEA719D33A35F6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
3e:57:91:bb:27:36:9f:9a:a0:02:05:d4:0b:70:2e:e6:64:79:e9:aa:17:ea:96:0b:9e:31:a2:d3:ae:8a:d8:9c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
Chains
Dec 29, 2025
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
01
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 1, 2004 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
Serial Number
b1:38:e6:66:0d:ca:7c:c3:77:cb:2f:6f:60:27:f6:16
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 13, 2023 - Jan 12, 2026
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Minor OS version
0
Major OS version
6
Entry point
4629555
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\admin\build-dir\CL-VLD-BW\vpn-client\platform\windows\vpnclient\capi\build-x86\AdGuardVpn.pdb
crypt32
CryptQueryObject
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
CryptMsgGetParam
CryptMsgClose
CertOpenSystemStoreA
CertEnumCertificatesInStore
version
VerQueryValueW
GetFileVersionInfoExW
GetFileVersionInfoSizeExW
iphlpapi
GetIpForwardTable2
FreeMibTable
GetExtendedTcpTable
ConvertInterfaceLuidToGuid
if_indextoname
GetTcpTable
GetTcp6Table
GetPerTcpConnectionEStats
GetAdaptersAddresses
SetPerTcpConnectionEStats
GetPerTcp6ConnectionEStats
SetPerTcp6ConnectionEStats
GetIpInterfaceEntry
SetIpInterfaceEntry
CreateUnicastIpAddressEntry
InitializeUnicastIpAddressEntry
CreateIpForwardEntry2
GetBestRoute2
InitializeIpForwardEntry
ConvertInterfaceLuidToIndex
InitializeIpInterfaceEntry
if_nametoindex
ntdll
VerSetConditionMask
RtlUnwind
RtlNtStatusToDosError
NtWriteFile
RtlIpv6StringToAddressExA
ws2_32
inet_pton
WSARecv
inet_ntop
bind
htonl
htons
ntohs
socket
WSAIoctl
getaddrinfo
freeaddrinfo
ntohl
connect
setsockopt
shutdown
getsockopt
accept
getprotobyname
getservbyname
getprotobynumber
getservbyport
getnameinfo
WSASetLastError
select
recv
WSASendTo
WSARecvFrom
WSASocketW
WSASend
WSAGetOverlappedResult
WSADuplicateSocketW
listen
ioctlsocket
closesocket
WSAStartup
getsockname
getpeername
WSAGetLastError
sendto
recvfrom
send
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WaitOnAddress
WakeByAddressAll
bcryptprimitives
ProcessPrng
fwpuclnt
FwpmSubLayerAdd0
FwpmProviderAdd0
FwpmTransactionAbort0
FwpmTransactionCommit0
FwpmFreeMemory0
FwpmFilterAdd0
FwpmGetAppIdFromFileName0
FwpmEngineOpen0
FwpmEngineClose0
FwpmTransactionBegin0
kernel32
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
InitOnceComplete
InitOnceBeginInitialize
GetTickCount64
AreFileApisANSI
GetFileAttributesExW
SleepConditionVariableSRW
GetExitCodeThread
GetLocaleInfoEx
RaiseException
TryAcquireSRWLockExclusive
EnumSystemLocalesW
CompareStringEx
GetCPInfo
IsProcessorFeaturePresent
UnhandledExceptionFilter
InitializeSListHead
IsDebuggerPresent
InterlockedPushEntrySList
InterlockedFlushSList
ExitThread
SetUnhandledExceptionFilter
GetModuleFileNameW
LocalAlloc
LocalFree
VerifyVersionInfoW
FormatMessageW
GetModuleHandleW
GetProcAddress
GetModuleHandleA
GetLastError
CloseHandle
SetLastError
SetEvent
ResetEvent
CreateEventW
WaitForMultipleObjects
FreeLibrary
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentProcess
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
Sleep
GetSystemInfo
VirtualAlloc
VirtualProtect
VirtualFree
PostQueuedCompletionStatus
GetFileType
GetConsoleMode
SetHandleInformation
CreateIoCompletionPort
CancelIo
CreateEventA
SwitchToThread
SetFileCompletionNotificationModes
RegisterWaitForSingleObject
UnregisterWait
SetErrorMode
GetQueuedCompletionStatus
DebugBreak
FormatMessageA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCurrentDirectoryW
GetCurrentProcessId
GetSystemTimeAsFileTime
FileTimeToSystemTime
MultiByteToWideChar
FreeLibraryAndExitThread
TryEnterCriticalSection
DeleteCriticalSection
WakeConditionVariable
WakeAllConditionVariable
ReleaseSemaphore
WaitForSingleObject
ResumeThread
TlsAlloc
GetModuleHandleExW
TlsSetValue
TlsFree
CreateSemaphoreA
SetConsoleCtrlHandler
CreateFileA
CreateFileW
FlushFileBuffers
ReadFile
WriteFile
DuplicateHandle
ConnectNamedPipe
PeekNamedPipe
CreateNamedPipeW
CancelIoEx
CancelSynchronousIo
GetCurrentThread
QueueUserWorkItem
GetNumberOfConsoleInputEvents
ReadConsoleInputW
ReadConsoleW
WriteConsoleW
FillConsoleOutputCharacterW
FillConsoleOutputAttribute
GetConsoleCursorInfo
SetConsoleCursorInfo
GetConsoleScreenBufferInfo
SetConsoleCursorPosition
SetConsoleTextAttribute
WriteConsoleInputW
TerminateProcess
GetExitCodeProcess
UnregisterWaitEx
LCMapStringW
GetLongPathNameW
ReadDirectoryChangesW
LoadLibraryA
FindClose
FindFirstFileW
FindNextFileW
GetFileInformationByHandle
GetFileSizeEx
GetFullPathNameW
SetFilePointerEx
DeviceIoControl
UnmapViewOfFile
MoveFileExW
GetFileInformationByHandleEx
GetStdHandle
GetStartupInfoW
GetCurrentThreadId
GetThreadContext
SetThreadContext
FlushInstructionCache
VirtualQuery
LoadLibraryExW
GetSystemDirectoryA
InitializeCriticalSectionAndSpinCount
GetTickCount
RtlCaptureContext
ReleaseMutex
GetCommandLineW
SetFileInformationByHandle
GetProcessHeap
HeapFree
HeapReAlloc
WaitForSingleObjectEx
lstrlenW
CreateMutexA
GetOverlappedResult
FindFirstFileExW
ExitProcess
GetConsoleOutputCP
CreateThread
HeapAlloc
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
InitOnceExecuteOnce
LoadLibraryW
GetDriveTypeW
GetLogicalDriveStringsW
QueryDosDeviceW
GetVersionExA
GetTimeZoneInformation
SetStdHandle
SystemTimeToTzSpecificLocalTime
GetDateFormatW
GetTimeFormatW
CompareStringW
GetLocaleInfoW
IsValidLocale
TlsGetValue
SetEndOfFile
OutputDebugStringW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetUserDefaultLCID
WideCharToMultiByte
HeapSize
user32
GetMessageA
GetSystemMetrics
MapVirtualKeyW
TranslateMessage
DispatchMessageA
advapi32
StartServiceA
QueryServiceStatus
OpenServiceA
OpenSCManagerA
CreateServiceW
CloseServiceHandle
RegSetValueExA
SystemFunction036
RegSetKeyValueA
RegQueryValueExA
RegOpenKeyExA
RegEnumKeyExA
RegCloseKey
wintrust
WinVerifyTrust
locations_pinger_runner_create
locations_pinger_runner_free
locations_pinger_runner_run
sockaddr_from_str_out
tls_free_serialized_cert
tls_free_serialized_chain
tls_get_cert
tls_get_chain
tls_serialize_cert
tls_serialize_cert_chain
vpn_abandon_endpoint
vpn_address_array_destroy_contents
vpn_backend_client_create
vpn_backend_client_destroy
vpn_backend_client_get_authorization_link
vpn_backend_client_make_request
vpn_backend_client_notify_network_change
vpn_backend_client_response_free_content
vpn_backend_client_string_free
vpn_backend_get_tds_base_link
vpn_close
vpn_cm_close
vpn_cm_get_endpoint
vpn_cm_open
vpn_cm_start
vpn_cm_stop
vpn_complete_connect_request
vpn_connect
vpn_create_netfilter_listener
vpn_create_os_tunnel_settings
vpn_create_socks_listener
vpn_create_tun_listener
vpn_dns_stamp_free
vpn_dns_stamp_from_str
vpn_dns_stamp_prettier_url
vpn_dns_stamp_pretty_url
vpn_dns_stamp_to_str
vpn_force_disconnect
vpn_force_reconnect
vpn_get_capi_version_hash
vpn_get_event_loop
vpn_get_socks_listener_address
vpn_handler_profiling_enabled
vpn_handler_profiling_set_enabled
vpn_handler_profiling_threshold_ns
vpn_listen
vpn_listener_config_clone
vpn_listener_config_destroy
vpn_network_manager_notify_app_request_domain
vpn_network_manager_set_outbound_interface
vpn_notify_network_change
vpn_open
vpn_os_tunnel_settings_clone
vpn_os_tunnel_settings_defaults
vpn_os_tunnel_settings_destroy
vpn_post_quantum_group_enabled
vpn_post_quantum_group_set_enabled
vpn_request_endpoint_connection_stats
vpn_reset_connections
vpn_stop
vpn_string_free
vpn_suggest_tunnel_included_routes
vpn_update_exclusions
vpn_validate_dns_upstream
vpn_validate_exclusion
vpn_win_detect_active_if
vpn_win_socket_protect
vpn_win_tunnel_create
vpn_win_tunnel_destroy
vpn_win_tunnel_settings_clone
vpn_win_tunnel_settings_defaults
vpn_win_tunnel_settings_destroy
vpn_windows_close
vpn_windows_crash
vpn_windows_disable_set_unhandled_exception_filter
vpn_windows_enable_set_unhandled_exception_filter
vpn_windows_get_client_version
vpn_windows_listen
vpn_windows_notify_dns_change
vpn_windows_open
vpn_windows_set_log_callback
vpn_windows_set_log_level
Name
.text
Size
4.7MB
Virtual Size
4.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.4MB
Virtual Size
1.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
99KB
Virtual Size
2.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.detourc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.detourd
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
153KB
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=21, id=259, version=30795,
count=215, id=261, version=30795,
count=8, id=253, version=35207,
count=17, id=260, version=35207,
count=26, id=259, version=35207,
count=91, id=261, version=35207,
count=81, productName=Unmarked objects (old),
count=27, id=260, version=30795,
count=16, id=260, version=32537,
count=80, id=261, version=34435,
count=2, id=261, version=32537,
count=415, id=260, version=34435,
count=25, id=257, version=30795,
count=415, id=1, productName=Unmarked objects,
count=36, id=260, version=35217,
count=162, id=261, version=35217,
count=1, id=256, version=35217,
count=1, id=255, version=35217,
count=1, id=151,
count=1, id=258, version=35217,
x86/ExtraBypass.dll
- IMPHASH d75e28e95315ad872c1c816e98caee7e
- SHA256 f96f8b66f2fb99077a4eff2cf55c1500f334d71ba425c3989453ab5dae190c6e
- MD5 18c9f48b88bd2241a265919a4cd4a794
- SHA1 d1823f9e5fa97b4bd2196b791710e56c93e4d99f
- SHA512 54f391618df12bb996589a3bafc4e4431b9f99051818630918c406a14a6332e133070bcf804a7349c2b2a0dad3bb9138db11ab699e5ad23b03dcde85bc081b4f
- SSDEEP 1536:MMFBplMH3yTvs+w9sDPOgeFIMKMcbNYUGsWKlcd714KktdVmAz92deM8wvU:MMvfMiTE3IOgQcbc71PEVmAp2dP8wvU
- TLSH T1E8A37B11B690D075EDBE1D305868CA729B3EB820EEE0DD9B3759066E4F303D1DE2492B
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
ce:1c:2d:df:88:16:46:47:83:c1:04:1a:11:f4:3d:c5:80:8a:e0:72:f9:5e:38:d0:24:ab:10:40:52:18:19:06
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
Chains
Aug 11, 2025
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
Serial Number
b1:38:e6:66:0d:ca:7c:c3:77:cb:2f:6f:60:27:f6:16
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 13, 2023 - Jan 12, 2026
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
01
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 1, 2004 - Dec 31, 2028
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Minor OS version
0
Major OS version
6
Entry point
8535
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BWU-JOB1\AdGuard.Commons\build\bin\Release\x86\AGIpHelperClose.pdb
kernel32
GetNamedPipeInfo
OpenProcess
GetFileType
GetCurrentProcess
CloseHandle
WriteConsoleW
GetModuleHandleW
GetProcAddress
DuplicateHandle
LoadLibraryA
CreateFileW
SetFilePointerEx
GetConsoleMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
MultiByteToWideChar
LCMapStringW
DeleteFileW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStdHandle
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
DecodePointer
advapi32
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
ws2_32
getpeername
getsockopt
WSACleanup
WSAStartup
WSAGetLastError
shutdown
CloseSocketsByPid
SetTcpEntry6
Name
.text
Size
51KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=29395,
count=138, id=261, version=29395,
count=20, id=260, version=29395,
count=18, id=259, version=34321,
count=16, id=260, version=34321,
count=34, id=261, version=34321,
count=7, id=257, version=29395,
count=94, id=1, productName=Unmarked objects,
count=4, id=265, version=34435,
count=1, id=256, version=34435,
count=1, id=255, version=34435,
count=1, id=151,
count=1, id=258, version=34435,
x86/SQLite.Interop.dll
- IMPHASH ae94e7e35747470c61bf70e22ccd5d26
- SHA256 1a6845e27761e5c26c1cfa128d2d2360d24e05d229008bc2f0b4215a03366dc9
- MD5 6112b48951eddb62e78ba86d239fb2a3
- SHA1 3219cc358a61073823294fb6cbea081a9ec2fc01
- SHA512 71022aa649c5751a2abb7b9b618747009c22c45518dafd7df307193e873308eccdf7303b7f8554a541c9f02006e488bfe3567ab61e6fde3806415b810ca6612e
- SSDEEP 24576:6KE4r0RaYdKYR7KtLqUmZRDiJC7Z2CQiQYZh5YAIQLsV5:phr0RZ5RGtA0KpcYZ8tEs/
- TLSH T165458C52FA8381A1E9E111F5A2FE2FB7097C1609432888E7D3A46CD49E600D3767F76D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
d9:bc:31:ac:67:b4:d5:3c:99:32:d3:6b:2a:c6:dc:c8:77:66:dd:ee:d7:b5:ca:c4:8e:e9:73:d1:df:28:97:e1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
Chains
May 21, 2024
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
Serial Number
b1:38:e6:66:0d:ca:7c:c3:77:cb:2f:6f:60:27:f6:16
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 13, 2023 - Jan 12, 2026
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
11266
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\dev\sqlite\dotnet\bin\2012\Win32\ReleaseNativeOnlyStatic\SQLite.Interop.pdb
kernel32
UnmapViewOfFile
SetEndOfFile
FreeLibrary
HeapAlloc
SystemTimeToFileTime
QueryPerformanceCounter
HeapFree
WaitForSingleObject
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
GetSystemTimeAsFileTime
FormatMessageA
WriteFile
InitializeCriticalSection
WideCharToMultiByte
LoadLibraryW
Sleep
FormatMessageW
GetVersionExW
HeapDestroy
GetFileAttributesA
LeaveCriticalSection
HeapCreate
MapViewOfFile
GetFileAttributesW
ReadFile
CreateFileW
MultiByteToWideChar
FlushFileBuffers
GetTempPathW
GetLastError
GetProcAddress
HeapSize
LockFileEx
EnterCriticalSection
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
CreateFileMappingW
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
DeleteCriticalSection
OutputDebugStringA
GetCurrentThreadId
GetVersionExA
CloseHandle
DeleteFileW
GetCurrentProcessId
GetTempPathA
LocalFree
GetSystemTime
AreFileApisANSI
DeleteFileA
TryEnterCriticalSection
SetFilePointer
HeapCompact
CreateMutexW
GetFileSize
CreateFileA
HeapReAlloc
GetFullPathNameA
HeapValidate
GetFullPathNameW
EncodePointer
DecodePointer
CreateThread
ExitThread
LoadLibraryExW
IsDebuggerPresent
IsProcessorFeaturePresent
GetCommandLineA
GetTimeZoneInformation
SetLastError
InterlockedIncrement
InterlockedDecrement
ExitProcess
GetModuleHandleExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
InitializeCriticalSectionAndSpinCount
GetCurrentProcess
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetStdHandle
GetFileType
GetModuleFileNameA
GetEnvironmentStringsW
FreeEnvironmentStringsW
RaiseException
GetModuleFileNameW
RtlUnwind
GetStringTypeW
CompareStringW
LCMapStringW
SetEnvironmentVariableA
GetConsoleCP
GetConsoleMode
SetStdHandle
SetFilePointerEx
WriteConsoleW
advapi32
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptDuplicateKey
CryptDeriveKey
CryptAcquireContextW
CryptHashData
_interop_compileoption_get@4
_interop_compileoption_used@4
_interop_libversion@0
_interop_sourceid@0
_sqlite3_backup_finish_interop@4
_sqlite3_bind_double_interop@12
_sqlite3_bind_int64_interop@12
_sqlite3_bind_parameter_name_interop@12
_sqlite3_blob_close_interop@4
_sqlite3_changes_interop@4
_sqlite3_close_interop@4
_sqlite3_column_database_name16_interop@12
_sqlite3_column_database_name_interop@12
_sqlite3_column_decltype16_interop@12
_sqlite3_column_decltype_interop@12
_sqlite3_column_double_interop@12
_sqlite3_column_int64_interop@12
_sqlite3_column_name16_interop@12
_sqlite3_column_name_interop@12
_sqlite3_column_origin_name16_interop@12
_sqlite3_column_origin_name_interop@12
_sqlite3_column_table_name16_interop@12
_sqlite3_column_table_name_interop@12
_sqlite3_column_text16_interop@12
_sqlite3_column_text_interop@12
_sqlite3_context_collcompare_interop@20
_sqlite3_context_collseq_interop@16
_sqlite3_create_disposable_module_interop@112
_sqlite3_create_function_interop@36
_sqlite3_cursor_rowid_interop@12
_sqlite3_errmsg_interop@8
_sqlite3_finalize_interop@4
_sqlite3_index_column_info_interop@32
_sqlite3_last_insert_rowid_interop@8
_sqlite3_malloc_size_interop@4
_sqlite3_memory_highwater_interop@8
_sqlite3_memory_used_interop@4
_sqlite3_open16_interop@20
_sqlite3_open_interop@20
_sqlite3_prepare16_interop@24
_sqlite3_prepare_interop@24
_sqlite3_reset_interop@4
_sqlite3_result_double_interop@8
_sqlite3_result_int64_interop@8
_sqlite3_table_column_metadata_interop@44
_sqlite3_table_cursor_interop@12
_sqlite3_value_double_interop@8
_sqlite3_value_int64_interop@8
_sqlite3_value_text16_interop@8
_sqlite3_value_text_interop@8
sqlite3_activate_see
sqlite3_aggregate_context
sqlite3_aggregate_count
sqlite3_auto_extension
sqlite3_backup_finish
sqlite3_backup_init
sqlite3_backup_pagecount
sqlite3_backup_remaining
sqlite3_backup_step
sqlite3_bind_blob
sqlite3_bind_blob64
sqlite3_bind_double
sqlite3_bind_int
sqlite3_bind_int64
sqlite3_bind_null
sqlite3_bind_parameter_count
sqlite3_bind_parameter_index
sqlite3_bind_parameter_name
sqlite3_bind_pointer
sqlite3_bind_text
sqlite3_bind_text16
sqlite3_bind_text64
sqlite3_bind_value
sqlite3_bind_zeroblob
sqlite3_bind_zeroblob64
sqlite3_blob_bytes
sqlite3_blob_close
sqlite3_blob_open
sqlite3_blob_read
sqlite3_blob_reopen
sqlite3_blob_write
sqlite3_busy_handler
sqlite3_busy_timeout
sqlite3_cancel_auto_extension
sqlite3_changes
sqlite3_clear_bindings
sqlite3_close
sqlite3_close_v2
sqlite3_collation_needed
sqlite3_collation_needed16
sqlite3_column_blob
sqlite3_column_bytes
sqlite3_column_bytes16
sqlite3_column_count
sqlite3_column_database_name
sqlite3_column_database_name16
sqlite3_column_decltype
sqlite3_column_decltype16
sqlite3_column_double
sqlite3_column_int
sqlite3_column_int64
sqlite3_column_name
sqlite3_column_name16
sqlite3_column_origin_name
sqlite3_column_origin_name16
sqlite3_column_table_name
sqlite3_column_table_name16
sqlite3_column_text
sqlite3_column_text16
sqlite3_column_type
sqlite3_column_value
sqlite3_commit_hook
sqlite3_compileoption_get
sqlite3_compileoption_used
sqlite3_complete
sqlite3_complete16
sqlite3_config
sqlite3_context_db_handle
sqlite3_create_collation
sqlite3_create_collation16
sqlite3_create_collation_v2
sqlite3_create_disposable_module
sqlite3_create_function
sqlite3_create_function16
sqlite3_create_function_v2
sqlite3_create_module
sqlite3_create_module_v2
sqlite3_data_count
sqlite3_data_directory
sqlite3_db_cacheflush
sqlite3_db_config
sqlite3_db_filename
sqlite3_db_handle
sqlite3_db_mutex
sqlite3_db_readonly
sqlite3_db_release_memory
sqlite3_db_status
sqlite3_declare_vtab
sqlite3_dispose_module
sqlite3_enable_load_extension
sqlite3_enable_shared_cache
sqlite3_errcode
sqlite3_errmsg
sqlite3_errmsg16
sqlite3_errstr
sqlite3_exec
sqlite3_expanded_sql
sqlite3_expired
sqlite3_extended_errcode
sqlite3_extended_result_codes
sqlite3_file_control
sqlite3_finalize
sqlite3_free
sqlite3_free_table
sqlite3_fts5_init
sqlite3_fts_init
sqlite3_get_autocommit
sqlite3_get_auxdata
sqlite3_get_table
sqlite3_global_recover
sqlite3_initialize
sqlite3_interrupt
sqlite3_json_init
sqlite3_key
sqlite3_key_v2
sqlite3_last_insert_rowid
sqlite3_libversion
sqlite3_libversion_number
sqlite3_limit
sqlite3_load_extension
sqlite3_log
sqlite3_malloc
sqlite3_malloc64
sqlite3_memory_alarm
sqlite3_memory_highwater
sqlite3_memory_used
sqlite3_mprintf
sqlite3_msize
sqlite3_mutex_alloc
sqlite3_mutex_enter
sqlite3_mutex_free
sqlite3_mutex_leave
sqlite3_mutex_try
sqlite3_next_stmt
sqlite3_open
sqlite3_open16
sqlite3_open_v2
sqlite3_os_end
sqlite3_os_init
sqlite3_overload_function
sqlite3_percentile_init
sqlite3_prepare
sqlite3_prepare16
sqlite3_prepare16_v2
sqlite3_prepare16_v3
sqlite3_prepare_v2
sqlite3_prepare_v3
sqlite3_preupdate_count
sqlite3_preupdate_depth
sqlite3_preupdate_hook
sqlite3_preupdate_new
sqlite3_preupdate_old
sqlite3_profile
sqlite3_progress_handler
sqlite3_randomness
sqlite3_realloc
sqlite3_realloc64
sqlite3_regexp_init
sqlite3_rekey
sqlite3_rekey_v2
sqlite3_release_memory
sqlite3_reset
sqlite3_reset_auto_extension
sqlite3_result_blob
sqlite3_result_blob64
sqlite3_result_double
sqlite3_result_error
sqlite3_result_error16
sqlite3_result_error_code
sqlite3_result_error_nomem
sqlite3_result_error_toobig
sqlite3_result_int
sqlite3_result_int64
sqlite3_result_null
sqlite3_result_pointer
sqlite3_result_subtype
sqlite3_result_text
sqlite3_result_text16
sqlite3_result_text16be
sqlite3_result_text16le
sqlite3_result_text64
sqlite3_result_value
sqlite3_result_zeroblob
sqlite3_result_zeroblob64
sqlite3_rollback_hook
sqlite3_rtree_geometry_callback
sqlite3_rtree_query_callback
sqlite3_set_authorizer
sqlite3_set_auxdata
sqlite3_set_last_insert_rowid
sqlite3_sha_init
sqlite3_shutdown
sqlite3_sleep
sqlite3_snprintf
sqlite3_soft_heap_limit
sqlite3_soft_heap_limit64
sqlite3_sourceid
sqlite3_sql
sqlite3_status
sqlite3_status64
sqlite3_step
sqlite3_stmt_busy
sqlite3_stmt_readonly
sqlite3_stmt_status
sqlite3_strglob
sqlite3_stricmp
sqlite3_strlike
sqlite3_strnicmp
sqlite3_system_errno
sqlite3_table_column_metadata
sqlite3_temp_directory
sqlite3_test_control
sqlite3_thread_cleanup
sqlite3_threadsafe
sqlite3_total_changes
sqlite3_totype_init
sqlite3_trace
sqlite3_trace_v2
sqlite3_transfer_bindings
sqlite3_update_hook
sqlite3_uri_boolean
sqlite3_uri_int64
sqlite3_uri_parameter
sqlite3_user_data
sqlite3_value_blob
sqlite3_value_bytes
sqlite3_value_bytes16
sqlite3_value_double
sqlite3_value_dup
sqlite3_value_free
sqlite3_value_int
sqlite3_value_int64
sqlite3_value_numeric_type
sqlite3_value_pointer
sqlite3_value_subtype
sqlite3_value_text
sqlite3_value_text16
sqlite3_value_text16be
sqlite3_value_text16le
sqlite3_value_type
sqlite3_version
sqlite3_vfs_find
sqlite3_vfs_register
sqlite3_vfs_unregister
sqlite3_vmprintf
sqlite3_vsnprintf
sqlite3_vtab_config
sqlite3_vtab_on_conflict
sqlite3_vtshim_init
sqlite3_wal_autocheckpoint
sqlite3_wal_checkpoint
sqlite3_wal_checkpoint_v2
sqlite3_wal_hook
sqlite3_win32_compact_heap
sqlite3_win32_is_nt
sqlite3_win32_mbcs_to_utf8
sqlite3_win32_mbcs_to_utf8_v2
sqlite3_win32_reset_heap
sqlite3_win32_set_directory
sqlite3_win32_sleep
sqlite3_win32_unicode_to_utf8
sqlite3_win32_utf8_to_mbcs
sqlite3_win32_utf8_to_mbcs_v2
sqlite3_win32_utf8_to_unicode
sqlite3_win32_write_debug
sqlite3changegroup_add
sqlite3changegroup_add_strm
sqlite3changegroup_delete
sqlite3changegroup_new
sqlite3changegroup_output
sqlite3changegroup_output_strm
sqlite3changeset_apply
sqlite3changeset_apply_strm
sqlite3changeset_concat
sqlite3changeset_concat_strm
sqlite3changeset_conflict
sqlite3changeset_finalize
sqlite3changeset_fk_conflicts
sqlite3changeset_invert
sqlite3changeset_invert_strm
sqlite3changeset_new
sqlite3changeset_next
sqlite3changeset_old
sqlite3changeset_op
sqlite3changeset_pk
sqlite3changeset_start
sqlite3changeset_start_strm
sqlite3session_attach
sqlite3session_changeset
sqlite3session_changeset_strm
sqlite3session_create
sqlite3session_delete
sqlite3session_diff
sqlite3session_enable
sqlite3session_indirect
sqlite3session_isempty
sqlite3session_patchset
sqlite3session_patchset_strm
sqlite3session_table_filter
Name
.text
Size
983KB
Virtual Size
983KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
182KB
Virtual Size
182KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
9KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=31, id=207, version=50929,
count=69, id=205, version=50929,
count=130, id=206, version=50929,
count=137, id=1, productName=Unmarked objects,
count=5, id=185, version=30716,
count=1, id=210, version=61219,
count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
x86/sciter.dll
- IMPHASH 84df9c2e374785a042d76da1e2d61985
- SHA256 acebb40ecd916a04d77ebc437a42d7287fe9250d4f24e4fdebae4507861253aa
- MD5 e138cc0a64a67c61d119dd327a7ad0c8
- SHA1 4fff6bca17d1430fa15c53888d3e4f6176f8ef52
- SHA512 b46ec47bfa629e76fb80f374de9e5f3f3bf9bb98f5a96fa4df2f3894eee7a3ef816430683614c8a1e32d1b3377c3f7c0de2b18357c50a6dc3ff5ee96be987620
- SSDEEP 393216:hwKndpRismVdv7DIk9zQXB5DCQNONiNIkWL:GK5+TDb9zQztkT
- TLSH T12BF6AE23B681C07DC01F02B05E4DF76A83BDAE704BF182937A983ADDAFB05D16A55617
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
55:87:d8:1b:67:e0:90:a5:5f:b6:36:22:cb:4e:fb:b5:b9:bd:27:2a:a2:37:b4:bf:47:07:98:9c:66:90:11:94
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
Chains
Nov 10, 2025
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Subject
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
01
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jan 1, 2004 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Serial Number
48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16
Issuer
CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 25, 2021 - Dec 31, 2028
Subject
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Serial Number
62:1d:6d:0c:52:01:9e:3b:90:79:15:20:89:21:1c:0a
Issuer
CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Mar 22, 2021 - Mar 21, 2036
Subject
CN=Adguard Software Limited,O=Adguard Software Limited,ST=Lefkosia,C=CY
Serial Number
b1:38:e6:66:0d:ca:7c:c3:77:cb:2f:6f:60:27:f6:16
Issuer
CN=Sectigo Public Code Signing CA R36,O=Sectigo Limited,C=GB
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jan 13, 2023 - Jan 12, 2026
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Minor OS version
0
Major OS version
6
Entry point
9640771
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
E:\sciter\work\sdk\bin\windows\x32\sciter.pdb
userenv
GetUserProfileDirectoryW
shlwapi
UrlCreateFromPathW
PathIsRelativeW
PathCreateFromUrlW
winmm
timeSetEvent
timeKillEvent
timeEndPeriod
timeGetTime
timeBeginPeriod
comctl32
ImageList_Destroy
ImageList_DrawEx
ImageList_GetIconSize
oleacc
LresultFromObject
AccessibleObjectFromWindow
usp10
ScriptItemize
ScriptFreeCache
ScriptShape
ws2_32
bind
WSARecvFrom
WSAIoctl
FreeAddrInfoW
setsockopt
GetAddrInfoW
getaddrinfo
freeaddrinfo
WSASendTo
select
WSAStartup
WSAGetLastError
ntohs
ntohl
getsockopt
closesocket
ioctlsocket
WSARecv
connect
socket
getsockname
getpeername
htonl
WSASetLastError
WSASocketW
listen
shutdown
htons
WSASend
wininet
HttpSendRequestA
InternetCloseHandle
InternetOpenA
HttpQueryInfoW
InternetConnectA
InternetSetOptionW
InternetReadFile
HttpQueryInfoA
InternetErrorDlg
HttpOpenRequestA
InternetQueryOptionW
imm32
ImmIsIME
ImmNotifyIME
ImmAssociateContextEx
ImmSetCandidateWindow
ImmGetCompositionStringW
ImmReleaseContext
ImmGetContext
kernel32
GetTempPathA
GetCommandLineW
GetCommandLineA
GetOEMCP
GetModuleHandleExA
HeapQueryInformation
GetSystemDirectoryA
FindFirstFileExW
GetModuleFileNameA
MultiByteToWideChar
Sleep
QueryPerformanceFrequency
QueryPerformanceCounter
SleepConditionVariableCS
TlsSetValue
EnterCriticalSection
GetCurrentProcess
ReleaseSemaphore
TryAcquireSRWLockExclusive
WakeAllConditionVariable
WakeConditionVariable
LeaveCriticalSection
InitializeCriticalSection
InitializeConditionVariable
WaitForSingleObject
ResumeThread
DuplicateHandle
CreateEventW
GetLastError
ReleaseSRWLockExclusive
SetEvent
GetCurrentThread
AcquireSRWLockExclusive
TlsAlloc
CloseHandle
GetNativeSystemInfo
DeleteCriticalSection
CreateSemaphoreW
TlsGetValue
TlsFree
GetStartupInfoW
GlobalAlloc
GlobalFree
GlobalLock
SetThreadExecutionState
GetModuleHandleW
GlobalUnlock
CompareStringW
GetSystemDefaultLCID
GetFullPathNameW
GetModuleFileNameW
GetLocaleInfoW
GetUserDefaultLCID
VerSetConditionMask
GetComputerNameW
WideCharToMultiByte
VerifyVersionInfoW
FindFirstFileW
FindNextFileW
FindClose
SetFilePointer
SetEndOfFile
CreateFileW
UnmapViewOfFile
FlushViewOfFile
GetFileSize
CreateFileMappingW
MapViewOfFile
GetTimeZoneInformation
SystemTimeToFileTime
GetSystemTime
GetProcAddress
FreeLibrary
LoadLibraryExW
MulDiv
SetLastError
SetEnvironmentVariableW
GetConsoleTitleW
GetEnvironmentVariableW
GetTempPathW
GetVersionExW
FreeEnvironmentStringsW
GetSystemInfo
GetCurrentDirectoryW
GetCurrentProcessId
GetSystemTimeAsFileTime
GetEnvironmentStringsW
OutputDebugStringW
LocalFree
FormatMessageA
DebugBreak
GetFileAttributesW
GetModuleHandleExW
FormatMessageW
GetConsoleMode
GetFileType
SetErrorMode
GetQueuedCompletionStatus
PostQueuedCompletionStatus
CreateIoCompletionPort
CancelIo
SetHandleInformation
RegisterWaitForSingleObject
UnregisterWait
CancelIoEx
SwitchToThread
SetFileCompletionNotificationModes
ReadFile
SetNamedPipeHandleState
CreateNamedPipeA
WriteFile
CreateNamedPipeW
PeekNamedPipe
QueueUserWorkItem
CancelSynchronousIo
CreateFileA
GetNamedPipeHandleStateW
WaitNamedPipeW
ConnectNamedPipe
FlushFileBuffers
OutputDebugStringA
GetCPInfo
GetModuleHandleA
LoadLibraryA
GetNumberFormatW
GetCurrencyFormatW
GetTimeFormatW
GetDateFormatW
SetConsoleCtrlHandler
GlobalSize
GetLongPathNameW
GetShortPathNameW
ReadDirectoryChangesW
SetInformationJobObject
AssignProcessToJobObject
TerminateProcess
CreateJobObjectW
UnregisterWaitEx
LCMapStringW
CreateProcessW
GetExitCodeProcess
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetConsoleMode
GetConsoleCursorInfo
SetConsoleCursorInfo
FillConsoleOutputCharacterW
ReadConsoleInputW
ReadConsoleW
ResetEvent
WriteConsoleInputW
FillConsoleOutputAttribute
WriteConsoleW
GetNumberOfConsoleInputEvents
SetConsoleCursorPosition
CreateDirectoryW
GetFileInformationByHandleEx
GetFileSizeEx
GetDiskFreeSpaceW
DeviceIoControl
RemoveDirectoryW
SetFileTime
ReOpenFile
CreateHardLinkW
GetFileInformationByHandle
SetFilePointerEx
MoveFileExW
CopyFileW
CreateSymbolicLinkW
InitializeCriticalSectionEx
DecodePointer
GetStdHandle
HeapFree
SetThreadPriority
HeapReAlloc
CreateThread
HeapAlloc
GetProcessHeap
LoadLibraryW
VirtualFree
VirtualAlloc
WaitForMultipleObjects
GetCurrentThreadId
lstrcmpW
SetDllDirectoryW
VirtualProtect
GetThreadPriority
GetTickCount
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
WaitForSingleObjectEx
GetExitCodeThread
GetTickCount64
EncodePointer
LCMapStringEx
GetStringTypeW
RaiseException
RtlUnwind
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
HeapSize
ExitThread
FreeLibraryAndExitThread
ExitProcess
SetStdHandle
GetConsoleOutputCP
GetFileAttributesExW
SetFileAttributesW
GetDriveTypeW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
IsValidLocale
EnumSystemLocalesW
IsValidCodePage
GetACP
user32
UpdateWindow
PtInRect
GetParent
KillTimer
SetRect
GetClassLongW
IsZoomed
GetClientRect
SetWindowLongW
FlashWindowEx
SetCursor
SetCapture
ClipCursor
LoadCursorW
LoadIconW
TranslateMessage
RegisterRawInputDevices
SetPropW
BringWindowToTop
SetFocus
SetLayeredWindowAttributes
GetMessageTime
MoveWindow
TrackMouseEvent
GetRawInputData
SetWindowPlacement
PeekMessageW
GetLayeredWindowAttributes
ClientToScreen
CreateIconIndirect
GetMonitorInfoW
DestroyIcon
SetTimer
DispatchMessageW
OffsetRect
GetAsyncKeyState
ShowWindow
GetActiveWindow
GetWindowPlacement
SetCursorPos
ReleaseDC
ReleaseCapture
WaitMessage
SetWindowTextW
RemovePropW
SendMessageW
ScreenToClient
CreateWindowExW
MonitorFromWindow
GetPropW
SetWindowPos
IsWindowVisible
GetDC
DestroyWindow
MapVirtualKeyW
PostMessageW
GetKeyState
DefWindowProcW
GetDoubleClickTime
MessageBeep
DestroyCaret
GetKeyboardLayout
CreateCaret
SetCaretPos
UnregisterDeviceNotification
ToUnicode
RegisterDeviceNotificationW
UnregisterClassW
EnumDisplaySettingsW
EnumDisplayDevicesW
EnumDisplaySettingsExW
EnumDisplayMonitors
ChangeDisplaySettingsExW
GetWindowTextW
GetDesktopWindow
IsWindow
GetWindowThreadProcessId
GetRawInputDeviceList
GetRawInputDeviceInfoA
GetClipboardSequenceNumber
RegisterClipboardFormatW
GetMessageW
PostThreadMessageW
GetQueueStatus
SetForegroundWindow
LoadImageW
InvalidateRect
MsgWaitForMultipleObjects
GetCursorPos
BeginPaint
EndPaint
EnableWindow
DeferWindowPos
AdjustWindowRectEx
GetWindowRect
IsIconic
GetSystemMetrics
BeginDeferWindowPos
MapWindowPoints
GetSysColor
EndDeferWindowPos
SystemParametersInfoW
RegisterWindowMessageW
GetWindowLongW
RegisterClassExW
WindowFromDC
WindowFromPoint
NotifyWinEvent
gdi32
DeleteDC
DeleteObject
GetDeviceCaps
CreateCompatibleDC
ChoosePixelFormat
SwapBuffers
SetPixelFormat
CreateDIBSection
CreateRectRgn
DescribePixelFormat
GetTextMetricsW
SelectObject
GetDeviceGammaRamp
AddFontMemResourceEx
GetFontUnicodeRanges
EnumFontFamiliesExW
SetGraphicsMode
GetTextFaceW
GdiFlush
CreateDCW
SetTextColor
GetFontData
SetBkMode
GetTextExtentPointI
GetGlyphIndicesW
GetCharABCWidthsW
GetGlyphOutlineW
RemoveFontMemResourceEx
CreateFontIndirectW
GetOutlineTextMetricsW
SetTextAlign
ExtTextOutW
SetWorldTransform
StretchDIBits
SetDeviceGammaRamp
CreateBitmap
comdlg32
GetOpenFileNameW
GetSaveFileNameW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
GetUserNameW
OpenProcessToken
SystemFunction036
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
shell32
DragQueryFileW
SHGetFileInfoW
ord727
SHGetPathFromIDListW
SHBrowseForFolderW
SHGetSpecialFolderPathW
ShellExecuteExW
Shell_NotifyIconW
ord74
ole32
CoInitialize
CoTaskMemAlloc
CoUninitialize
CoFreeUnusedLibraries
RevokeDragDrop
OleGetClipboard
CoCreateInstance
OleSetClipboard
DoDragDrop
ReleaseStgMedium
OleInitialize
OleUninitialize
CoCreateGuid
CoTaskMemFree
RegisterDragDrop
oleaut32
SysFreeString
SafeArrayDestroy
SafeArrayPutElement
SafeArrayCreateVector
SysAllocStringLen
dxgi
CreateDXGIFactory1
SciterAPI
Name
.text
Size
10.0MB
Virtual Size
10.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3.4MB
Virtual Size
3.4MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
388KB
Virtual Size
3.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.fptable
Size
512B
Virtual Size
128B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
269KB
Virtual Size
268KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
622KB
Virtual Size
621KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=71, id=259, version=33136,
count=13, id=253, version=34321,
count=28, id=259, version=34321,
count=19, id=260, version=34321,
count=92, id=261, version=34321,
count=85, id=260, version=33136,
count=1, id=262, version=33136,
count=230, id=261, version=33136,
count=41, id=257, version=33136,
count=542, id=1, productName=Unmarked objects,
count=1843, id=265, version=34808,
count=1, id=256, version=34808,
count=1, id=255, version=34808,
count=1, id=151,
count=1, id=258, version=34808,
x86/wintun.dll
- IMPHASH 85d06bb8dccb5014c9a7a3146af5ef48
- SHA256 d694fa46ab4cfebcb2632d094c7aa97278eef2f8052438621766d863ae98a931
- MD5 fa0391a861b949de22e0a59c6faeaed5
- SHA1 d451ef2224b27938eeaa97ad26f75b686d86082e
- SHA512 e44889d0f3044f90962181d7d8787076f70b6e1d7974150f16f83d33a97f1fc4bdd0c7a38eee7a1ea8e8dc4f66ed37dab004f2855dd361de8fdd4ae6e08fa048
- SSDEEP 6144:w89wYsjDrSwf2IHHVVsWhC2njQtIu1MlXwiMnnyDQhWmnU4Dm:jjsjDrSOFaWFnjQtIzlXwiW/U46
- TLSH T1F1C4AE43A7D84467E5F79A3445738A526B3EB9300B30CACF53528A698E637C0DE34B76
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
43:08:7b:e6:e4:6f:97:89:4a:6c:3c:14:6c:cb:ca:a9:c4:46:23:57:4e:a7:6b:cc:2c:f8:a4:7c:b8:9a:8f:17
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=4227913,CN=WireGuard LLC,O=WireGuard LLC,L=Boulder,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Oct 17, 2021
SERIALNUMBER=4227913,CN=WireGuard LLC,O=WireGuard LLC,L=Boulder,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,1.3.6.1.4.1.311.60.2.1.3=#13025553
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 7, 2016 - Jan 7, 2031
Subject
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
61:20:4d:b4:00:00:00:00:00:27
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Apr 15, 2011 - Apr 15, 2021
Subject
SERIALNUMBER=4227913,CN=WireGuard LLC,O=WireGuard LLC,L=Boulder,ST=Colorado,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13044f68696f,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
06:63:d5:fc:a7:28:88:2f:36:ff:1b:df:5d:85:f0:ba
Issuer
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2018 - Dec 14, 2021
Subject
CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Issuer
CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 18, 2012 - Apr 18, 2027
Minor OS version
0
Major OS version
6
Entry point
31760
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Jason A. Donenfeld\Projects\wintun\Release\x86\wintun.pdb
kernel32
HeapCreate
GetCurrentProcess
LoadLibraryExA
CloseHandle
HeapDestroy
GetProcAddress
LocalFree
GetModuleHandleW
IsWow64Process
HeapFree
SetLastError
WaitForSingleObject
CreateFileW
OpenProcess
QueueUserWorkItem
CreateEventW
Sleep
GetLastError
SetEvent
HeapAlloc
GetCurrentProcessId
GetProcessTimes
RemoveDirectoryW
DeleteFileW
FormatMessageW
EnterCriticalSection
CreatePrivateNamespaceW
OpenPrivateNamespaceW
LeaveCriticalSection
InitializeCriticalSection
CreateBoundaryDescriptorW
CreateMutexW
ReleaseMutex
ClosePrivateNamespace
AddSIDToBoundaryDescriptor
DeleteCriticalSection
DeleteBoundaryDescriptor
ExpandEnvironmentStringsW
HeapReAlloc
CreateDirectoryW
SizeofResource
WriteFile
LockResource
LoadResource
FindResourceW
GetWindowsDirectoryW
VirtualFree
DeviceIoControl
VirtualAlloc
InitializeCriticalSectionAndSpinCount
ReadFile
SetHandleInformation
CreatePipe
GetExitCodeThread
CreateThread
CreateProcessW
DecodePointer
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapSize
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedFlushSList
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
WriteConsoleW
ntdll
NtQuerySystemInformation
RtlNtStatusToDosError
RtlGetNtVersionNumbers
NtQueryKey
NtQuerySystemTime
WintunAllocateSendPacket
WintunCloseAdapter
WintunCreateAdapter
WintunDeleteDriver
WintunEndSession
WintunGetAdapterLUID
WintunGetReadWaitEvent
WintunGetRunningDriverVersion
WintunOpenAdapter
WintunReceivePacket
WintunReleaseReceivePacket
WintunSendPacket
WintunSetLogger
WintunStartSession
Name
.text
Size
122KB
Virtual Size
121KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.didat
Size
512B
Virtual Size
268B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
348KB
Virtual Size
347KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=29395,
count=146, id=261, version=29395,
count=15, id=260, version=30034,
count=18, id=259, version=30034,
count=32, id=261, version=30034,
count=22, id=260, version=29395,
count=2, id=257, version=29395,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=183, id=1, productName=Unmarked objects,
count=9, id=264, version=30136,
count=1, id=256, productName=VS2019 v16.11.5 build 30136, version=30136,
count=1, id=255, productName=VS2019 v16.11.5 build 30136, version=30136,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.11.5 build 30136, version=30136,