2026-09-16_db5e516ce8d6ccccca3ea9db8bd2a41d_elex_maze_rhadamanthys

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-16_db5e516ce8d6ccccca3ea9db8bd2a41d_elex_maze_rhadamanthys
Size 4.8MB
Sample260916-tv77lashke
SHA256 3f6a4efe2b272ab6fc4fd6a02682dd6ae50da573f9afb8283737c35f9e44c1e4
MD5 db5e516ce8d6ccccca3ea9db8bd2a41d
SHA1 c5fc2724cf768c27d60d585319819e695d2d57fb
SHA512 8328489c7d35dcbc5da2724aa68dd30fe6c77196108de870437cca8d64d914ce27fdb3b7ac21e7293b6ecfa95e7bd1b8f37df65154ab5855b48c4e8ff879b2fd
SSDEEP 98304:Vbv1ZoQNo0Ttzl0N0DqOh0EHgYUlo/gZz5T4CRfKm312jfNsKy1mwP//KrVwL:tBNr5zZqOhKSI6wfKNBsK4mwP6r6L
TLSH
T1B53623E15962B452E21A107728D11CC7AD203DADEB816A6F0FC5B7336E23526F73721B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 14 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_db5e516ce8d6ccccca3ea9db8bd2a41d_elex_maze_rhadamanthys
unpack001/2345LeakFixer.exe
unpack001/2345MPCSafe.exe
unpack001/2345NetFlow.exe
unpack001/2345NetRepair.exe
unpack001/2345SafeLock.exe
unpack001/2345SafeSvc.exe
unpack001/2345SafeTray.exe
unpack001/2345SafeUpdate.exe
unpack001/2345Setting.exe
unpack001/2345ShellPro.exe
unpack001/2345SysDoctor.exe
unpack001/2345Uninst.exe
unpack001/Uninstall.exe

File Explorer

2026-09-16_db5e516ce8d6ccccca3ea9db8bd2a41d_elex_maze_rhadamanthys

.exe 4.8MB
$PLUGINSDIR/FileInfo.dll

.dll 1.2MB
$PLUGINSDIR/RCWidgetPlugin.dll

.dll 3.4MB
$PLUGINSDIR/System.dll

.dll 27KB
$PLUGINSDIR/libcurl_x86.dll

.dll 2.1MB
2345LeakFixer.exe

.exe 128KB
2345MPCSafe.exe

.exe 614KB
2345NetFlow.exe

.exe 85KB
2345NetRepair.exe

.exe 85KB
2345SafeLock.exe

.exe 87KB
2345SafeSvc.exe

.exe 1.1MB
2345SafeTray.exe

.exe 1.4MB
2345SafeUpdate.exe

.exe 674KB
2345Setting.exe

.exe 87KB
2345ShellPro.exe

.exe 1.4MB
2345SysDoctor.exe

.exe 85KB
2345Uninst.exe

.exe 1.7MB
$PLUGINSDIR/FileInfo.dll

.dll 1.2MB
$PLUGINSDIR/RCWidgetPlugin.dll

.dll 3.4MB
$PLUGINSDIR/System.dll

.dll 27KB
Uninstall.exe

.exe 882KB

2026-09-16_db5e516ce8d6ccccca3ea9db8bd2a41d_elex_maze_rhadamanthys

IMPHASH c552a31531df962b2298e689961d15c2
SHA256 3f6a4efe2b272ab6fc4fd6a02682dd6ae50da573f9afb8283737c35f9e44c1e4
MD5 db5e516ce8d6ccccca3ea9db8bd2a41d
SHA1 c5fc2724cf768c27d60d585319819e695d2d57fb
SHA512 8328489c7d35dcbc5da2724aa68dd30fe6c77196108de870437cca8d64d914ce27fdb3b7ac21e7293b6ecfa95e7bd1b8f37df65154ab5855b48c4e8ff879b2fd
SSDEEP 98304:Vbv1ZoQNo0Ttzl0N0DqOh0EHgYUlo/gZz5T4CRfKm312jfNsKy1mwP//KrVwL:tBNr5zZqOhKSI6wfKNBsK4mwP6r6L
TLSH
T1B53623E15962B452E21A107728D11CC7AD203DADEB816A6F0FC5B7336E23526F73721B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrlenA GetPrivateProfileStringW WritePrivateProfileStringW MoveFileW MultiByteToWideChar WideCharToMultiByte CreateFileW GetFileSize GetTickCount GetModuleFileNameW GetProcAddress GetCommandLineW SetEnvironmentVariableW WriteFile GetTempPathW SetErrorMode HeapAlloc HeapFree GetProcessHeap GetCurrentProcess GetCurrentProcessId ExitProcess GetVersion GetWindowsDirectoryW LoadLibraryW CopyFileW GetDiskFreeSpaceW CreateThread GlobalLock GlobalUnlock lstrcmpiW lstrlenW CreateDirectoryW GetTempFileNameW RemoveDirectoryW WaitForSingleObject GetExitCodeProcess CreateProcessW GetSystemDirectoryW GetModuleHandleA lstrcmpiA lstrcpyA lstrcatW MoveFileExW TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent VirtualQuery RtlUnwind IsProcessorFeaturePresent lstrcmpW FormatMessageW MulDiv LocalFree GlobalFree GlobalAlloc LoadLibraryExW GetModuleHandleW FreeLibrary Sleep GetLastError CloseHandle SetFileTime SetFilePointer SetFileAttributesW ReadFile GetShortPathNameW GetFullPathNameW GetFileAttributesW FindNextFileW FindFirstFileW FindClose DeleteFileW CompareFileTime SearchPathW SetCurrentDirectoryW lstrcpynW ExpandEnvironmentStringsW

user32

ScreenToClient GetSysColor GetWindowLongW SetClassLongW LoadCursorW SystemParametersInfoW wsprintfA DispatchMessageW PeekMessageW SetDlgItemTextW GetDlgItemTextW SetCursor CharPrevW MessageBoxIndirectW GetSystemMetrics IsWindowEnabled EmptyClipboard SetClipboardData CloseClipboard OpenClipboard CheckDlgButton EndDialog DialogBoxParamW GetWindowRect TrackPopupMenu AppendMenuW EnableMenuItem CreatePopupMenu CharNextA GetSystemMenu IsWindowVisible SetWindowPos CreateWindowExW GetClassInfoW RegisterClassW CallWindowProcW GetMessagePos CharNextW ExitWindowsEx SetWindowTextW CreateDialogParamW DestroyWindow PostMessageW LoadImageW FindWindowExW SetWindowLongW InvalidateRect ReleaseDC GetDC DefWindowProcW DrawTextW BeginPaint EndPaint GetClientRect SetForegroundWindow EnableWindow GetDlgItem ShowWindow IsWindow PostQuitMessage SendMessageTimeoutW SendMessageW wsprintfW FillRect SetTimer

gdi32

SetBkColor GetDeviceCaps SetTextColor SetBkMode SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW

shell32

ShellExecuteExW SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW SHFileOperationW SHGetSpecialFolderLocation

advapi32

RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RegSetValueExW RegCreateKeyExW SetFileSecurityW RegCloseKey RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegOpenKeyExW

comctl32

ImageList_Create ImageList_Destroy ImageList_AddMasked ord17

ole32

OleUninitialize OleInitialize CoCreateInstance CoTaskMemFree

$PLUGINSDIR/FileInfo.dll

IMPHASH 24dba5f7faae071e4de747a3d14d4a2b
SHA256 fe577e6af8fd32d800d292d12e02358359fda97b9a376b60c20453798003a50a
MD5 db196b83cd9fbfceaaa3e5560f0a187d
SHA1 de234f418cef7ff87dc5737dbb8423eac51306e2
SHA512 0468911a356f11faeea256f6e6d8ea70ff2ea4adf8f3e041eab86dbeec882823c8f0d00f747a3477c3d877106cfa90d8c1e6059cb0cb52671ce155dd84af91fe
SSDEEP 24576:zPt6/WIZSALHQZWhIuO1EY28XTvO0ONVBz87VtiqC:z0WtAzhhOdXTGBvBz87VtiqC
TLSH
T162455C116286C277E55E01B01B2D9E7E506C75302B6088CBF7C46F6EA9F0DD29632EE7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

a1:08:f3:51:6d:a2:1e:2e:28:2c:e7:d5:b1:65:dd:8e:32:24:78:ef:8d:e6:84:79:0b:c9:fb:ed:55:09:b8:36

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=913101150729060470,CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=上海市,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#0c0ce6b5a6e4b89ce696b0e58cba,1.3.6.1.4.1.311.60.2.1.2=#0c09e4b88ae6b5b7e5b882,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Nov 14, 2023

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

4a:c0:4d:74:e1:6f:ce:e7:8b:45:a1:de:ee:bd:f3:96:b6:c7:96:73

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Nov 14, 2023

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

Serial Number

0d:7e:f8:80:11:79:bf:12:a7:46:6f:7d:a5:b3:27:7a

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 28, 2023 - Jul 7, 2026

Minor OS version

Major OS version

Entry point

749634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\C++\Safe\Rhino\Safe\Install\FileInfo\Bin\Win32\release_static\pdb\FileInfo.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

kernel32

WaitForSingleObject SetFileAttributesW GetPrivateProfileStringW Sleep GetLastError DeleteFileW CloseHandle LoadLibraryW GetProcAddress MoveFileExW CreateProcessW FreeLibrary GetTickCount TerminateProcess OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW GetCurrentProcessId lstrcpynW MultiByteToWideChar GlobalAlloc GlobalFree WideCharToMultiByte lstrcpyW WriteFile SetFilePointer CreateFileW GetFileSize SetLastError GetModuleFileNameW GetUserDefaultLangID GetCurrentThreadId GetLocalTime QueryDosDeviceW GetEnvironmentVariableW GetLogicalDriveStringsW VirtualQuery FileTimeToSystemTime FileTimeToLocalFileTime GetVersionExW LockResource GetSystemInfo LoadResource FindResourceW GetModuleHandleW lstrcmpiW FindFirstFileW GetLongPathNameW GetFileAttributesExW CreateMutexW ExpandEnvironmentStringsW GetACP WaitForMultipleObjects LocalFree GetExitCodeProcess OpenFileMappingW UnmapViewOfFile MapViewOfFile OpenEventW CreateEventW SetEvent ResetEvent ReleaseMutex EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection LoadLibraryExW FindNextFileW FindClose ReadFile SetFileTime SetEndOfFile GetFileTime CreateDirectoryW GetFullPathNameW lstrlenW GetFileAttributesW GetCurrentDirectoryW MoveFileW HeapFree HeapAlloc GetProcessHeap InterlockedExchangeAdd InterlockedExchange GlobalMemoryStatusEx GetFileSizeEx ResumeThread CreateThread OutputDebugStringW HeapSize WriteConsoleW GetTempPathW InitializeCriticalSectionAndSpinCount RemoveDirectoryW GetDiskFreeSpaceW GetCurrentProcess DeviceIoControl ExitThread SearchPathW FreeLibraryAndExitThread SetStdHandle SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA FlushFileBuffers GetTimeZoneInformation GetConsoleCP ReadConsoleW GetConsoleMode SetFilePointerEx HeapReAlloc EnumSystemLocalesW FormatMessageW SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime EncodePointer DecodePointer GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW GetStdHandle GetFileType RtlUnwind RaiseException InterlockedFlushSList ExitProcess GetModuleHandleExW GetModuleFileNameA IsValidLocale GetUserDefaultLCID

advapi32

RegCloseKey RegFlushKey RegCreateKeyExW RegSetValueExW

shell32

SHChangeNotify ShellExecuteW SHGetFolderPathW SHGetPathFromIDListW SHGetSpecialFolderPathW

ole32

CoCreateInstance

oleaut32

SysAllocString VariantClear

shlwapi

PathIsNetworkPathW PathIsRootW PathAddBackslashW PathFileExistsW

$PLUGINSDIR/RCWidgetPlugin.dll

IMPHASH ae8510b68862e16e1c4b71f50fa99067
SHA256 a6389a33c27b1ca3579b123781cb28f11336861bb2435d9e5906e942f1cc37d2
MD5 06804039ba720dbb60232aff87ddf0d0
SHA1 1bb0b48c816271701e0e237998da27634e3b44ac
SHA512 7b203977d6794886130b72881c1e219c1a47cbc3eba11d2e62fbab34ea9f3b2ed9c7e8fd08768e1476a56069270a4046c93796be992df82c0c0e324e2d0d4795
SSDEEP 49152:8X3z9pQajjCWDrSRKtGRZuSJDpU0Yo3oEdOT9SUh/1PgTQPNICAk4doPd1:8HzbPn/BcpVU0YOooPQ3
TLSH
T1E3F59E11B7828172E68E0172166D9AAF44783E14076548DBA3C83F3FAE715E3773BA17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

73:10:e5:55:84:b9:61:81:8c:9e:27:76:b1:19:bb:7a:74:10:35:54:3a:fb:85:b2:71:50:96:70:05:bf:52:ba

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

Chains

Oct 28, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

e0:73:62:c3:bd:62:c9:c4:ad:84:85:08:ea:bb:fb:cd:79:74:14:9e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Oct 28, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

Serial Number

0d:7e:f8:80:11:79:bf:12:a7:46:6f:7d:a5:b3:27:7a

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 28, 2023 - Jul 7, 2026

Minor OS version

Major OS version

Entry point

1997138

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\CPP\Safe\Rhino\Safe\Install\RCSetup\Bin\Win32\release_static\pdb\RCWidgetPlugin.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

ws2_32

getsockopt listen recv recvfrom send sendto setsockopt shutdown socket connect WSAGetLastError closesocket getsockname freeaddrinfo getaddrinfo ntohl inet_addr ntohs htons WSACleanup WSAStartup getpeername bind ioctlsocket select accept

kernel32

GlobalAlloc GlobalFree WideCharToMultiByte lstrcpyW GetVersionExW FindFirstFileW lstrlenW FindClose GetFileAttributesW lstrcatW WriteFile SetFilePointer GetLocalTime GetUserDefaultLangID QueryDosDeviceW GetEnvironmentVariableW GetLogicalDriveStringsW VirtualQuery InterlockedIncrement InterlockedDecrement EnterCriticalSection LeaveCriticalSection GetVersionExA TryEnterCriticalSection InterlockedExchange GetSystemTimeAsFileTime OpenProcess GetCurrentProcess TerminateProcess GetStdHandle DuplicateHandle CreateProcessW GetStartupInfoW SetEvent CreateEventW GetLongPathNameW ExpandEnvironmentStringsW GetCurrentDirectoryW ResetEvent ReleaseMutex WaitForMultipleObjects CreateMutexW LocalFree FormatMessageW SetEndOfFile SetFileTime CreateDirectoryW SetFileAttributesW GetFileAttributesExW DeleteFileW MoveFileExW GetSystemInfo SetEnvironmentVariableA FindNextFileW FreeLibrary GetProcAddress LoadLibraryExW GetFileSize GetTickCount SetLastError InterlockedExchangeAdd GetPrivateProfileStringW LoadLibraryW GlobalMemoryStatusEx GetModuleHandleW SearchPathW ResumeThread LockResource LoadResource FindResourceW lstrcmpiW InitializeCriticalSection GetACP FileTimeToSystemTime IsValidCodePage GetSystemTime ReadFile HeapFree HeapAlloc GetProcessHeap GetFileTime MultiByteToWideChar GetWindowsDirectoryW GetTempFileNameW MoveFileW LoadLibraryA DeviceIoControl GetFileSizeEx WaitForSingleObjectEx SwitchToThread GetCurrentThread GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo lstrcmpW MulDiv SizeofResource SetWaitableTimer CreateWaitableTimerW LocalAlloc FreeResource GlobalLock GlobalUnlock UnmapViewOfFile CreateFileMappingW MapViewOfFileEx GetModuleHandleA DisableThreadLibraryCalls CreateThread VirtualProtect GetModuleHandleExW OutputDebugStringA HeapCreate HeapDestroy FlushInstructionCache IsDebuggerPresent OutputDebugStringW InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList IsProcessorFeaturePresent VirtualAlloc VirtualFree LoadLibraryExA GetOEMCP GetFullPathNameA UnlockFileEx HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA FlushViewOfFile CreateFileA DeleteFileA HeapReAlloc HeapCompact UnlockFile CreateFileMappingA LockFileEx FormatMessageA MapViewOfFile FlushFileBuffers GetFileType CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask lstrcpynW GetCurrentThreadId WaitForSingleObject GetTempPathW CloseHandle CreateFileW SetErrorMode RegisterWaitForSingleObject UnregisterWait GetThreadTimes GetCommandLineA GetEnvironmentStringsW GetModuleFileNameW GetCurrentProcessId Sleep GetDiskFreeSpaceW DeleteCriticalSection DecodePointer RaiseException FreeEnvironmentStringsW GetLastError InitializeCriticalSectionAndSpinCount GetFullPathNameW GetCommandLineW RtlUnwind ExitThread ExitProcess GetModuleFileNameA SetFilePointerEx GetConsoleMode ReadConsoleW GetConsoleCP IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation FindFirstFileExA FindNextFileA SetStdHandle WriteConsoleW LockFile InterlockedCompareExchange AreFileApisANSI SetUnhandledExceptionFilter UnhandledExceptionFilter SystemTimeToFileTime SetThreadContext GetThreadContext FreeLibraryAndExitThread ReleaseSemaphore InterlockedFlushSList QueryDepthSList UnregisterWaitEx Thread32Next Thread32First SuspendThread CreateToolhelp32Snapshot OpenThread

user32

MonitorFromWindow IsWindowVisible GetDC ShowWindowAsync AdjustWindowRectEx GetWindowTextLengthW DialogBoxParamW UnionRect GetClassLongW PostQuitMessage SetRect UpdateLayeredWindow FillRect MsgWaitForMultipleObjects SetRectEmpty AttachThreadInput SetCaretPos LoadImageW LoadBitmapW GetDesktopWindow SetForegroundWindow ToAscii GetCaretBlinkTime GetKeyboardState GetSystemMetrics DrawIconEx GetIconInfo GetSysColor IsClipboardFormatAvailable GetClipboardData CloseClipboard SetClipboardData EmptyClipboard GetAncestor RegisterWindowMessageW EnumThreadWindows CreateAcceleratorTableW LoadStringW GetFocus GetAsyncKeyState GetMonitorInfoW IsChild MapWindowPoints ValidateRect MoveWindow SetFocus ShowWindow InvalidateRgn OpenClipboard SetTimer SetWindowRgn GetClassNameW SetParent GetDlgItem KillTimer SetWindowTextW DestroyAcceleratorTable BeginPaint EndPaint EnableWindow GetKeyState ScreenToClient TrackMouseEvent SetCapture ReleaseCapture SetWindowPos EqualRect EnumChildWindows OffsetRect CopyRect ClientToScreen IntersectRect GetWindowDC SetCursor GetClientRect IsZoomed GetParent InvalidateRect GetDCEx IsIconic ReleaseDC GetCursorPos CreateWindowExW RegisterClassExW IsRectEmpty LoadCursorW GetClassInfoExW CharPrevW CharNextW wsprintfW GetMessageW DispatchMessageW PeekMessageW TranslateMessage PostThreadMessageW SystemParametersInfoW GetWindowThreadProcessId GetWindow GetWindowRect MessageBoxW IsWindow GetForegroundWindow FindWindowW PtInRect GetWindowTextW PostMessageW GetActiveWindow LoadIconW EndDialog GetWindowLongW DefWindowProcW CallWindowProcW DestroyWindow SendMessageW UnregisterClassW SetWindowLongW SetPropW RemovePropW GetPropW RedrawWindow

advapi32

RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW QueryServiceStatus CloseServiceHandle OpenSCManagerW StartServiceW OpenServiceW RegCloseKey

ole32

CoCreateInstance CoTaskMemFree CoTaskMemRealloc CreateStreamOnHGlobal CoTaskMemAlloc OleUninitialize StringFromGUID2 CLSIDFromProgID CLSIDFromString OleLockRunning CoGetClassObject OleInitialize

shell32

DragQueryFileW SHGetFolderPathW SHGetSpecialFolderPathW SHGetPathFromIDListW SHBrowseForFolderW DragFinish

oleaut32

SysAllocStringLen SysStringLen DispCallFunc VarUI4FromStr LoadTypeLi VariantInit LoadRegTypeLi SysAllocString VariantClear OleCreateFontIndirect SysFreeString

shlwapi

PathFindFileNameW ord12 StrToIntA PathAppendW StrDupW

comctl32

InitCommonControlsEx _TrackMouseEvent

gdi32

CreateFontIndirectW CreateSolidBrush DeleteObject GetObjectW SetTextColor GetStockObject GetRgnBox SetViewportOrgEx CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt GetDeviceCaps CreatePolygonRgn CreateRectRgnIndirect SetWorldTransform SetGraphicsMode SetBkColor EnumFontsW PtInRegion CreateRoundRectRgn CreateDIBSection GetClipBox GetDIBits CreateDCW ExtTextOutW DeleteDC

msimg32

AlphaBlend

urlmon

CoInternetCreateZoneManager CoInternetCreateSecurityManager

imm32

ImmNotifyIME ImmAssociateContextEx ImmGetContext ImmSetCompositionWindow ImmReleaseContext ImmGetCompositionStringW

gdiplus

GdipCreateSolidFill GdipCloneBitmapArea GdipGetCellDescent GdipSetInterpolationMode GdipSetLinePresetBlend GdipCreateFont GdipSetStringFormatLineAlign GdipCreatePath GdipEndContainer GdipSetSmoothingMode GdipCreateMatrix GdipGetStringFormatAlign GdipDeletePath GdipDisposeImageAttributes GdipCreateMatrix2 GdipDeleteBrush GdipGetLineSpacing GdipSetLineWrapMode GdipCreateLineBrushI GdipDrawImageRectRect GdipSaveGraphics GdipCreateFontFamilyFromName GdipGetEmHeight GdipGetStringFormatLineAlign GdipAddPathString GdipGetTextRenderingHint GdipGetFamily GdipSetCompositingQuality GdipSetImageAttributesColorMatrix GdipGetLineTransform GdipDeleteFontFamily GdipGetInterpolationMode GdipCreateRegionPath GdipAddPathLineI GdipAddPathBezierI GdipCombineRegionPath GdipAddPathEllipseI GdipAddPathArcI GdipAddPathRectangleI GdipCombineRegionRegion GdipSetStringFormatTrimming GdipSetLineTransform GdipSetTextureTransform GdipSetCompositingMode GdipCreateHBITMAPFromBitmap GdipTransformRegion GdipFillPath GdipGetPathWorldBounds GdipFillRectangleI ord1 GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipGetFontSize GdipTranslateWorldTransform GdipDeletePen GdipCreatePen1 GdipSetStringFormatAlign GdipDrawImageRectRectI GdipDeleteMatrix GdipGetFamilyName GdipCloneRegion GdipSetStringFormatFlags GdipGetImagePixelFormat GdipCloneBitmapAreaI GdipCreateBitmapFromFile GdipCreateBitmapFromScan0 GdipGetImageHeight GdipImageGetFrameDimensionsCount GdipCloneImage GdipBitmapUnlockBits GdipGetPropertyItem GdipCreateBitmapFromStream GdipAlloc GdipDisposeImage GdipFree GdipImageSelectActiveFrame GdipBitmapLockBits GdipImageGetFrameDimensionsList GdipImageGetFrameCount GdipGetImageWidth GdipGetPropertyItemSize GdiplusStartup GdipMultiplyWorldTransform GdipGraphicsClear GdipSetPenDashStyle GdipDrawLine GdipDrawRectangle GdipSetPixelOffsetMode GdipScaleWorldTransform GdipSetClipRectI GdipClosePathFigure GdipGetSmoothingMode GdipDrawArcI GdipCreateImageAttributes GdipSetClipRegion GdipDrawPath GdipDrawString GdipSetImageAttributesWrapMode GdipGetClipBoundsI GdipGetFontStyle GdipCreateFromHDC GdipFillEllipse GdipBeginContainer2 GdipCreateTexture GdipGetTextureTransform GdipGetMatrixElements GdipCloneStringFormat GdipSetTextRenderingHint GdipGetCellAscent GdipStringFormatGetGenericTypographic GdipRotateWorldTransform GdipRestoreGraphics GdipCloneBrush GdipMeasureString GdipDeleteRegion GdipGetBrushType GdipGetImageGraphicsContext

winmm

timeGetTime

psapi

GetMappedFileNameW

generic

count=27, id=241, version=40116,

count=166, id=243, version=40116,

count=35, id=242, version=40116,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, productName=Unmarked objects (old),

count=3, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,

count=31, id=259, version=26706,

count=12, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=123, id=261, version=26706,

count=36, id=260, version=26706,

count=2, id=260, version=27035,

count=61, id=261, version=27035,

count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=688, id=1, productName=Unmarked objects,

count=283, id=265, version=27051,

count=1, id=256, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,

$PLUGINSDIR/System.dll

IMPHASH 216ff05c01e38b13fee53b7ace6b1894
SHA256 0b399864057723bd388f8924baca252f8ca582287f5862460d042bfb8d2f11bc
MD5 219b2454333b6a78e6a365bbaab66321
SHA1 44224f5bea0d9b1d39da783273277e2750c81444
SHA512 5e87a00c7dd23d26c7287c5d082721d37893a6408adcd9dda272499143e5cbe84177d62c611131f7b4e242693510d658630ebb3721007758cc9eb348d5282e39
SSDEEP 384:HxoXlBT3SaMINWf52+4kb1VYnYPLYZJzk/holCZsHL0Fu8JN77hh1nY:HypSvIWb3J2iClfC3hbY
TLSH
T144D25C42AB651CF2FAD68E3930E4F52B5D30B7D067D1C8E756A9C4406FC17D229B818E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

e2:2a:29:61:3d:2e:db:f3:c1:d8:06:ab:50:62:3e:3c:ce:8a:52:6d:8c:a2:53:79:ce:9c:25:cb:c3:dd:a4:98

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=91310115591679552Q,CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=Shanghai,C=CN,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#13085368616e67686169,1.3.6.1.4.1.311.60.2.1.3=#1302434e

Chains

Jul 14, 2020

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

01:ff:77:6e:f8:da:13:72:ac:88:d1:3e:ed:4e:11:10:e9:9f:01:22

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

Chains

Jul 14, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

06:ea:0d:de:d5:5e:c1:e1:a2:9f:c5:fb:5d:ab:4f:b2

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2020 - May 18, 2023

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

Serial Number

05:aa:43:30:0d:17:67:ac:12:49:43:54:21:65:bb:9e

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2020 - May 18, 2023

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

7584

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/libcurl_x86.dll

IMPHASH 64d8089c328d441f097db6a50d840bc2
SHA256 97b88d15406bdd99e4b2c89d1e366a400bc96d31dd4987c8fa02733c6296ff83
MD5 d2ca43a21ec1681e36bf5fc79a4d2b78
SHA1 1900808917de89cf3ceef7a50f33c24e0041294a
SHA512 3086da224b6886448b802c66eaaf909b236343bdb3a25a7a187a92a287068519703e23fd8c79e8b831c868374f59613d28560e0d706912bfc96be39875f89526
SSDEEP 49152:XGUR9r6hl8IXBPZ68L20v/SU8Y7NriOPquwgtJIpT:XGUR9r6b8IbBLjv/SUp7NriSo
TLSH
T1AAA5AE02FB8185B2E6DB427862FA677F8E3A55205328C9D3C79138749D201D2773E79E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

e2:4a:00:44:60:0c:ad:d4:00:29:36:d8:9c:d0:cf:f5:f9:10:04:90:56:4a:4e:3e:db:e4:d1:67:0b:12:3b:45

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=Shanghai,C=CN

Chains

Sep 18, 2020

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=Shanghai,C=CN

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

77:59:7e:f8:fc:5f:0d:2f:b5:62:1d:bf:3b:0f:de:14:9b:43:3f:64

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=Shanghai,C=CN

Chains

Sep 18, 2020

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=Shanghai,C=CN

Subject

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=Shanghai,C=CN

Serial Number

0b:d8:a6:92:ce:d9:a1:8c:53:0f:a8:5d:55:72:c0:d4

Issuer

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 7, 2020 - Jun 12, 2023

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID Code Signing CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0f:a8:49:06:15:d7:00:a0:be:21:76:fd:c5:ec:6d:bd

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 11, 2011 - Feb 10, 2026

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 10, 2006 - Nov 10, 2021

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Shanghai 2345 Mobile Technology Co.\, Ltd.,OU=IT,O=Shanghai 2345 Mobile Technology Co.\, Ltd.,ST=Shanghai,C=CN

Serial Number

09:eb:8e:00:26:88:42:f0:dc:0c:60:43:a6:d5:61:91

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 2, 2020 - Jun 12, 2023

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Serial Number

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 1, 2019 - Oct 17, 2030

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 7, 2016 - Jan 7, 2031

Minor OS version

Major OS version

Entry point

1403272

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\dev\lib.vs2017\vendor\depends\curl\out\bin\Win32\release_static\pdb\libcurl_x86.pdb

ws2_32

closesocket getpeername getsockname getsockopt htons ntohs recv setsockopt socket WSASetLastError WSAIoctl getaddrinfo WSAGetLastError freeaddrinfo gethostname accept listen ioctlsocket __WSAFDIsSet select send WSAStartup WSACleanup recvfrom sendto gethostbyname bind connect shutdown htonl ntohl getservbyname

wldap32

ord145 ord301 ord147 ord133 ord79 ord142 ord167 ord127 ord27 ord26 ord118 ord41 ord208 ord216 ord14 ord46 ord219

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore

kernel32

GetCurrentDirectoryW SetCurrentDirectoryW HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW HeapFree HeapAlloc GetACP GetStringTypeW DecodePointer GetCurrentThread WaitForSingleObjectEx OutputDebugStringW OutputDebugStringA HeapSize WriteConsoleW GetProcessHeap SetEnvironmentVariableW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SleepEx MultiByteToWideChar WideCharToMultiByte WaitForSingleObject CloseHandle ExpandEnvironmentStringsA Sleep GetLastError SetLastError FormatMessageA VerSetConditionMask FreeLibrary GetProcAddress LoadLibraryW GetModuleHandleW GetSystemDirectoryW QueryPerformanceFrequency VerifyVersionInfoW WaitForMultipleObjects GetFileType GetStdHandle ReadFile PeekNamedPipe GetTickCount QueryPerformanceCounter FlushConsoleInputBuffer WriteFile GetCurrentThreadId GetModuleHandleA GetCurrentProcessId LoadLibraryA GlobalMemoryStatus GetSystemTime SystemTimeToFileTime GetConsoleCP ReadConsoleW GetModuleFileNameW GetModuleFileNameA ExitProcess SetConsoleMode ReadConsoleInputA PeekConsoleInputA SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindFirstFileA GetCPInfo GetOEMCP IsValidCodePage FindNextFileW FindNextFileA FindFirstFileExW FindFirstFileExA FindClose GetTimeZoneInformation SetEndOfFile SetFileAttributesW GetFileAttributesExW FlushFileBuffers GetNumberOfConsoleInputEvents SetStdHandle GetFullPathNameA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedPushEntrySList InterlockedFlushSList RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer RaiseException CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW CreateFileW GetDriveTypeW SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetFilePointerEx SetConsoleCtrlHandler GetConsoleMode GetFullPathNameW

user32

GetDC GetDesktopWindow MessageBoxA GetUserObjectInformationW GetProcessWindowStation ReleaseDC

gdi32

GetDeviceCaps GetDIBits GetObjectA DeleteObject CreateCompatibleBitmap

advapi32

RegisterEventSourceA DeregisterEventSource CryptEnumProvidersA CryptSignHashA CryptDestroyHash CryptCreateHash CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptReleaseContext CryptAcquireContextA ReportEventA

curl_easy_cleanup curl_easy_duphandle curl_easy_escape curl_easy_getinfo curl_easy_init curl_easy_pause curl_easy_perform curl_easy_recv curl_easy_reset curl_easy_send curl_easy_setopt curl_easy_strerror curl_easy_unescape curl_easy_upkeep curl_escape curl_formadd curl_formfree curl_formget curl_free curl_getdate curl_getenv curl_global_cleanup curl_global_init curl_global_init_mem curl_global_sslset curl_maprintf curl_mfprintf curl_mime_addpart curl_mime_data curl_mime_data_cb curl_mime_encoder curl_mime_filedata curl_mime_filename curl_mime_free curl_mime_headers curl_mime_init curl_mime_name curl_mime_subparts curl_mime_type curl_mprintf curl_msnprintf curl_msprintf curl_multi_add_handle curl_multi_assign curl_multi_cleanup curl_multi_fdset curl_multi_info_read curl_multi_init curl_multi_perform curl_multi_remove_handle curl_multi_setopt curl_multi_socket curl_multi_socket_action curl_multi_socket_all curl_multi_strerror curl_multi_timeout curl_multi_wait curl_mvaprintf curl_mvfprintf curl_mvprintf curl_mvsnprintf curl_mvsprintf curl_pushheader_byname curl_pushheader_bynum curl_share_cleanup curl_share_init curl_share_setopt curl_share_strerror curl_slist_append curl_slist_free_all curl_strequal curl_strnequal curl_unescape curl_url curl_url_cleanup curl_url_dup curl_url_get curl_url_set curl_version curl_version_info

2345LeakFixer.exe

IMPHASH 9e18128b125ba25cf6c1c0d3cacdaffd
SHA256 70db11d4e5b08ed09dc963f95e7d595820e09913556c2a820b9d1f034a4aa1c1
MD5 a5128b50996762cfb7a8023c31c5a3a9
SHA1 b698c626e42530b33b556132983bf5678f696810
SHA512 0cf2f0dcd2c1864f7a84eaf61f5a3fe2bccff1b8d4fa9f3e526dd147c84991ea382628fd2033eb4587ab23ac80620b2770488f1cc36ee90cf8badf8d5240599e
SSDEEP 3072:NIIIIgdv/VVcfkRkOjmn0AXlILP+b7jQ5wWh+fFZB/iICT274U7lQEl5k:NIIIIgxfolI7+bwJT8Lk
TLSH
T142D37E6275C18599F60A863150A81AB975323E7F2B401ACF1B80BF7579722C1BD73A2F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19870

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\pc-2345mpcsafe-build\Rhino\Safe\Bin\Win32\release\pdb\2345LeakFixer.pdb

gdiplus

GdiplusStartup GdiplusShutdown

kernel32

GetLastError CloseHandle GetFileAttributesW lstrlenW GetFullPathNameW CreateMutexW DeleteCriticalSection InitializeCriticalSection GetCurrentProcess GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW GetProcAddress GetCurrentThreadId GetModuleHandleW GetModuleFileNameW LoadLibraryW FreeLibrary

msvcp140

?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z

vcruntime140

_CxxThrowException memmove __CxxFrameHandler3 wcschr _except_handler4_common __std_exception_copy __std_exception_destroy memset memcpy

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _seh_filter_exe _set_app_type _configure_wide_argv terminate _controlfp_s _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_wide_environment _get_wide_winmain_command_line _initterm _register_thread_local_exe_atexit_callback _c_exit _cexit _initterm_e _exit exit

api-ms-win-crt-string-l1-1-0

towlower towupper

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh malloc

api-ms-win-crt-math-l1-1-0

_except1 __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

2345MPCSafe.exe

IMPHASH 9fe38e500d9e9f4fc47dcd641f6aef42
SHA256 66cc7eab6d1b51dd5a682d63bd257b2c3c1f5d1c098f85990c3f6b4d4bd4cb4c
MD5 afb3d956314c7e382522b22353587844
SHA1 d371db5b1a499fbf7432a4c1311ff24f7baf0581
SHA512 7e85f0c8c2493f86a8ce87530fee1de1c01c118956d9e256d9dc0b005a3cd7c455d947b87fbade9ef1ba5ef5163dcfd6d75bfa5238519f0f9cfa10f7c643f658
SSDEEP 12288:O9Uld8ULeNfDvTGt32hARs9EFdcIbifNwJTjdm5GwZ12:XL4rvCtG6uIbifNwFu312
TLSH
T11AD45B103721C236FF82D273176ADB6B41796E685F6305CF52D47B79A8312F2163EA22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

199652

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\pc-2345mpcsafe-build\Rhino\Safe\Bin\Win32\release\pdb\2345MPCSafe.pdb

basicsqlite

??0RCSQLiteConnection@RC@@QAE@XZ ??1RCSQLiteConnection@RC@@QAE@XZ

gdiplus

GdiplusStartup GdiplusShutdown

imm32

ImmDisableIME

kernel32

CreateSemaphoreW CreateThread TerminateThread GetProcessId ReleaseSemaphore RtlCaptureContext lstrcmpW CreateEventA GetSystemTimeAsFileTime QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter GetCurrentThreadId CreateFileW LocalAlloc GetCurrentProcess InterlockedIncrement GetProcessHeap UnhandledExceptionFilter InitializeSListHead InterlockedExchangeAdd InitializeCriticalSectionAndSpinCount GetModuleFileNameW lstrlenW GetFullPathNameW CreateDirectoryW GetFileSize ReadFile WaitForSingleObject FindClose LoadLibraryA GetFileAttributesW GetFileAttributesExW FindFirstFileW WideCharToMultiByte MultiByteToWideChar DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection MapViewOfFile CreateFileMappingW UnmapViewOfFile OpenFileMappingW FreeLibrary LoadLibraryW CreateProcessW WaitForMultipleObjects lstrcmpiW FindResourceW LoadResource LockResource HeapAlloc GetVersionExW GetEnvironmentVariableW ResetEvent SetEvent Sleep CreateEventW GetWindowsDirectoryW GetModuleHandleExW SetFilePointer WriteFile LocalFree GetLocalTime InterlockedDecrement HeapFree GetCurrentProcessId GetLastError CreateMutexW OpenMutexW CloseHandle GetModuleHandleW GetProcAddress ReleaseMutex VirtualQueryEx SetNamedPipeHandleState TransactNamedPipe WaitNamedPipeW OpenProcess SetThreadPriority GetExitCodeThread GetTimeZoneInformation TlsFree TlsSetValue TlsAlloc

user32

SetForegroundWindow IsWindow ShowWindow SendMessageW GetWindowLongW wsprintfW

advapi32

FreeSid CreateServiceW CloseServiceHandle OpenSCManagerW DeleteService ControlService StartServiceW EnumServicesStatusExW QueryServiceConfigW QueryServiceConfig2W OpenServiceW QueryServiceStatusEx AllocateAndInitializeSid EqualSid GetTokenInformation

msvcp140

?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z _Mtx_destroy_in_situ ?classic@locale@std@@SAABV12@XZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@O@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z ?uncaught_exception@std@@YA_NXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ

shlwapi

PathFileExistsW

vcruntime140

__std_exception_destroy __RTDynamicCast _set_purecall_handler __RTtypeid memchr memmove memcpy __std_type_info_compare memset _CxxThrowException _except_handler4_common wcschr __std_terminate __std_type_info_name __CxxFrameHandler3 strchr _purecall strstr __std_exception_copy

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn _register_thread_local_exe_atexit_callback _c_exit _errno _exit exit _initterm_e strerror_s _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv terminate _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _set_invalid_parameter_handler _initterm _controlfp_s

api-ms-win-crt-convert-l1-1-0

atoi _itow_s

api-ms-win-crt-string-l1-1-0

isspace wcscpy_s towupper towlower _stricmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf __stdio_common_vswprintf_s __stdio_common_vsprintf _set_fmode __acrt_iob_func __stdio_common_vsnwprintf_s __stdio_common_vfprintf __stdio_common_vsprintf_s __p__commode

api-ms-win-crt-time-l1-1-0

_localtime64 _mktime64

api-ms-win-crt-heap-l1-1-0

realloc _set_new_mode _callnewh free malloc

api-ms-win-crt-filesystem-l1-1-0

_splitpath_s

api-ms-win-crt-math-l1-1-0

_except1 __setusermatherr floor _dtest _finite _isnan ceil

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

2345NetFlow.exe

IMPHASH 9e18128b125ba25cf6c1c0d3cacdaffd
SHA256 ec9b3b5f0209a5fdd689d8f821704b352fe8773c38c90bc6b087e74fa445313f
MD5 33285e28362fe3ccea2fc769344d29e5
SHA1 2c2fd52658eb9d98ec7d75672dd9241f2723801a
SHA512 1e873c8083927cb43d059af820f1913ead4ff4a72862c1464490ec10288244d82e5455a625dea583711ddf7c88a6cb0e0812aef433927c866fa3b1e27e24c7f8
SSDEEP 1536:5rIIIIJ4VdCYaJYlQzeevLbheevLbmTE8076MlM7AlysD:hIIIIyEJ3zXvpXvOTq7lMElND
TLSH
T14E837C112AD2A462D4C1C67029345A6A71773D6F6F806FCB53907E35B8B2BC17A3236F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\pc-2345mpcsafe-build\Rhino\Safe\Bin\Win32\release\pdb\2345NetFlow.pdb

gdiplus

GdiplusStartup GdiplusShutdown

kernel32

msvcp140

?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z

vcruntime140

_CxxThrowException memmove __CxxFrameHandler3 wcschr _except_handler4_common __std_exception_copy __std_exception_destroy memset memcpy

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

towlower towupper

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh malloc

api-ms-win-crt-math-l1-1-0

_except1 __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

2345NetRepair.exe

IMPHASH 9e18128b125ba25cf6c1c0d3cacdaffd
SHA256 8d6af7a5b5767482d681ec764b46b3f6000f182f42a422914bbc2802ace239e7
MD5 2cefb853d4f27db93f8398992001ef07
SHA1 f8e6b51648079a445530784131156641c429cebb
SHA512 d776de921ffce706b8d817ac582725e805058de5ff98bc5d26c0556647f9a0c85d6d22029b2de853d309d12956739a071399e98156f77a587b3771cf20640813
SSDEEP 1536:LrIIIIT+NDzYa2mN23HZGEFBInwCAZGEFBInwC44GeJM76Mlrh7AltqW:XIIIITyT2d5GEHasGEHa4487lrhElj
TLSH
T1848317E19B428AA8E802C07458714E3FC46FAD795F9019CB0A5EBE360F6B3C365B545F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\pc-2345mpcsafe-build\Rhino\Safe\Bin\Win32\release\pdb\2345NetRepair.pdb

gdiplus

GdiplusStartup GdiplusShutdown

kernel32

msvcp140

?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z

vcruntime140

_CxxThrowException memmove __CxxFrameHandler3 wcschr _except_handler4_common __std_exception_copy __std_exception_destroy memset memcpy

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

towlower towupper

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh malloc

api-ms-win-crt-math-l1-1-0

_except1 __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

2345SafeLock.exe

IMPHASH cc614a9fbdc65feed0cc390fe30d3565
SHA256 b7ff1ca52a6dd3bd7e23a42ca6c10794a8c7968b46d71cd2bd5d874dcbbfac7f
MD5 97df6b0b6cbea5fe4a458435c338a075
SHA1 8ba188d5f83e6f5153c92173f271f685b4309adb
SHA512 c593d52cc63c71401d62217759113eb9de5e470a563dd2f3b96517d8d2d2ebbe80031d734a83dc83272288d50028d141d1ff4765b4d12c4d8b2cf4ba214b0469
SSDEEP 1536:3rIIII2rPR63tYNLgwUZGGMwIFThQlxwGGMwIFThQlxF4Ft76MlV7Aljj:bIIII2r5v0dZGGMw+QsGGMw+Q54X7lVi
TLSH
T1D79349126AD290A5D5C2C57010685A3AB5727E3F2F506ECF1784BF3275722C2BE3272E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20670

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\pc-2345mpcsafe-build\Rhino\Safe\Bin\Win32\release\pdb\2345SafeLock.pdb

gdiplus

GdiplusShutdown GdiplusStartup

kernel32

GetLastError CloseHandle GetProcAddress GetModuleHandleW lstrlenW GetFullPathNameW GetFileAttributesW DeleteCriticalSection InitializeCriticalSection GetCurrentProcess CreateMutexW FreeLibrary LoadLibraryW GetModuleFileNameW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetEnvironmentVariableW UnmapViewOfFile CreateFileMappingW MapViewOfFile GetCurrentProcessId GetCurrentThreadId

user32

IsWindow ShowWindow SendMessageW GetWindowLongW SetForegroundWindow

msvcp140

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z

vcruntime140

memmove memcpy __CxxFrameHandler3 memset _CxxThrowException __std_exception_destroy __std_exception_copy _except_handler4_common wcschr

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _invalid_parameter_noinfo _errno _seh_filter_exe terminate _controlfp_s _crt_atexit _register_onexit_function _initialize_onexit_table _set_app_type _register_thread_local_exe_atexit_callback _c_exit _cexit _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _exit exit _initterm_e _initterm

api-ms-win-crt-string-l1-1-0

towlower towupper

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode

api-ms-win-crt-math-l1-1-0

_except1 __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

2345SafeSvc.exe

IMPHASH 63420503b1bfa04963f661b5a6cb86a9
SHA256 9d2eb668203334e734f8263d725328b98168e1794049299d5b6edaf9f37671e8
MD5 2f4bd73adbe65c2554bbcd58ed93b543
SHA1 05cd0d3370108c00d23a35f02e2ed72401583737
SHA512 c261780f57bd9c343fb46a16418234bbc162f0321c8602ebd04472c8d7f691aec8f51adfc8abf19fca3403713cb0545bfe73358e5b3fc4935cbea89ba769b1c0
SSDEEP 24576:nq5bvAJF2DtrfK5RUy+AJW7JJQ5aMLngv/fNwuhg1:YRry7jW7JJQ1gHlw8g1
TLSH
T179457D707A83C437DA9221714BBCDA5E215DAD611F2259DB93C8373EEE704C21B3266B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

300177

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\pc-2345mpcsafe-build\Rhino\Safe\Bin\Win32\release\pdb\2345SafeSvc.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

psapi

GetProcessImageFileNameW

kernel32

HeapFree GetCurrentProcess GetLastError LoadLibraryW HeapAlloc GetProcAddress LocalFree GetProcessHeap GetModuleHandleW FreeLibrary GetUserDefaultLangID QueryDosDeviceW GetEnvironmentVariableW GetLogicalDriveStringsW VirtualQuery DeviceIoControl LocalAlloc GetSystemDirectoryW FileTimeToSystemTime FileTimeToLocalFileTime SetThreadExecutionState GetCurrentProcessId GetDriveTypeW OpenThread TerminateThread OutputDebugStringW Sleep MoveFileExW BeginUpdateResourceW UpdateResourceW EndUpdateResourceW WriteConsoleW SetStdHandle WaitForSingleObjectEx OutputDebugStringA SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExW FindFirstFileExA GetLocalTime GetCurrentThreadId CreateFileW SetFilePointer GetModuleFileNameW WriteFile CloseHandle OpenProcess WaitForSingleObject GetTickCount WaitForMultipleObjects HeapSize DecodePointer GetProcessTimes TryEnterCriticalSection GetTimeZoneInformation SetFilePointerEx ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetVersionExW LockResource GetSystemInfo LoadResource FindResourceW lstrcmpiW OpenEventW CreateEventW SetEvent ResetEvent GetComputerNameExW GlobalAlloc GlobalFree SearchPathW ExpandEnvironmentStringsW CreateProcessW GetExitCodeProcess FindFirstFileW GetLongPathNameW GetShortPathNameW GetFileAttributesExW CreateMutexW ReleaseMutex OpenMutexW WideCharToMultiByte SwitchToThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection GetACP MultiByteToWideChar GetVolumeInformationW GetDiskFreeSpaceW ResumeThread GetFileAttributesW LoadLibraryA OpenFileMappingW UnmapViewOfFile CreateFileMappingW MapViewOfFile ReadFile SetFileTime SetEndOfFile GetFileSize GetFileTime FindNextFileW FindClose LocalFileTimeToFileTime SystemTimeToFileTime GetSystemTime DosDateTimeToFileTime FileTimeToDosDateTime LoadLibraryExW CreateDirectoryW GetFullPathNameW lstrlenW RemoveDirectoryW GetTempPathW SetFileAttributesW DeleteFileW GetCurrentDirectoryW GetWindowsDirectoryW SetCurrentDirectoryW CopyFileW GetTempFileNameW MoveFileW InterlockedExchangeAdd lstrcatW lstrcpyW GetFileSizeEx InitializeCriticalSectionAndSpinCount FormatMessageW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead GetStdHandle GetFileType RtlUnwind RaiseException InterlockedPushEntrySList InterlockedFlushSList SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameA SetConsoleCtrlHandler GetCurrentThread GetStringTypeW HeapReAlloc GetDateFormatW GetTimeFormatW

user32

MessageBoxW GetUserObjectInformationW GetProcessWindowStation GetParent GetWindowThreadProcessId GetWindow FindWindowExW IsWindowVisible GetSystemMetrics OpenDesktopW CloseDesktop ExitWindowsEx FindWindowW GetClassNameW SwitchDesktop GetDesktopWindow WindowFromPoint

advapi32

SystemFunction036 ReportEventW RegisterEventSourceW DeregisterEventSource EqualSid LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid SetEntriesInAclW LookupPrivilegeNameW SetNamedSecurityInfoW OpenProcessToken FreeSid GetTokenInformation RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW

ole32

CoInitializeSecurity CoInitializeEx

rpcrt4

RpcServerRegisterIfEx NdrServerCall2 NdrAsyncServerCall RpcServerUseProtseqEpW RpcServerListen

imagehlp

ImageRemoveCertificate ImageEnumerateCertificates

Name

.text

Size

813KB

Virtual Size

812KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

196KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.msvcjmc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2345SafeTray.exe

IMPHASH ef857d781528aab1632e8309f0882e67
SHA256 63f16566001ff7e0572c4af36ca7322c845ce28ab0bfa41603b261db6dc352c6
MD5 d71d3ec77a8af9588f6cb88382f7b36d
SHA1 4d0c07fe9e5de01845992a98b19c57ace95e1ea7
SHA512 baa91b3ed17aa43f33557b44e5bbfca3d9ab72441fdaa6375466c9045e52822e777162a6b3fde56b06a2dd354722e2856aee69aea32bfad79da0c4ea806fc745
SSDEEP 24576:z4h1ckMZRSC0CMYScrYRNZQYivT+8zVQ7T0IdTmPdp+nAzxNwYZj5Ps9jM+qai6E:z4rZMZRSCHM3ccRNav7O7T00Tap+nAvr
TLSH
T164653A207346C626FAA181B1171CDE1A51687E742B6314CFF3C43B3968B1AE35B3AE57
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

752700

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\pc-2345mpcsafe-build\Rhino\Safe\Bin\Win32\release\pdb\2345SafeTray.pdb

basicsqlite

?Stop@RCSQLiteUpdateDMgr@RC@@SAXXZ ?Start@RCSQLiteUpdateDMgr@RC@@SAXXZ

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

gdiplus

GdiplusShutdown GdiplusStartup

imm32

ImmDisableIME

basicbusinessconfigcenter

?Stop@RCBasicBusinessConfigCenterDMgr@DM@RC@@QAE?AVRCReturnValue@23@XZ ?Start@RCBasicBusinessConfigCenterDMgr@DM@RC@@QAE?AVRCReturnValue@23@ABURCConfigCenterSetting@23@@Z ?GetInstance@RCBasicBusinessConfigCenterDMgr@DM@RC@@SAAAV123@XZ

kernel32

lstrlenW GetPrivateProfileStringW LoadLibraryW GlobalMemoryStatusEx FreeLibrary ExpandEnvironmentStringsW GetVersionExW GetCurrentProcess InitializeCriticalSectionAndSpinCount LocalFree GetFileAttributesW InterlockedDecrement HeapFree GetModuleHandleExW FileTimeToSystemTime FindClose FindNextFileW lstrcmpiW FindResourceW LoadResource GetSystemInfo SetLastError ResetEvent CreateEventW VirtualQuery MapViewOfFile CreateFileMappingW UnmapViewOfFile OpenFileMappingW GetDiskFreeSpaceW GetVolumeInformationW LoadLibraryExW LoadLibraryA DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetTickCount ReleaseMutex WideCharToMultiByte MultiByteToWideChar GetACP GetFileAttributesExW GetLongPathNameW FindFirstFileW CreateProcessW OpenProcess GetDriveTypeW InterlockedExchangeAdd LockResource SetEvent WaitForSingleObject WaitForMultipleObjects GetFileSize DeleteFileW Sleep SetEndOfFile ReadFile GetWindowsDirectoryW HeapAlloc GetFullPathNameW GetTempPathW SetFileAttributesW GetCurrentDirectoryW CreateDirectoryW InterlockedIncrement GetLogicalDriveStringsW GetEnvironmentVariableW QueryDosDeviceW GetUserDefaultLangID GetCurrentProcessId GetLocalTime GetCurrentThreadId CreateFileW SetFilePointer GetModuleFileNameW WriteFile CloseHandle GetLastError CreateMutexW GetModuleHandleW GetProcAddress InterlockedExchange SetFileTime GetFileTime ResumeThread GetProcessHeap GetFileSizeEx DeviceIoControl FormatMessageW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead SetThreadPriority GetExitCodeThread TlsAlloc TlsSetValue TlsFree GetTimeZoneInformation IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter OutputDebugStringW WaitNamedPipeW TransactNamedPipe SetNamedPipeHandleState VirtualQueryEx CreateSemaphoreW CreateThread TerminateThread GetProcessId ReleaseSemaphore RtlCaptureContext lstrcmpW CreateEventA LocalAlloc GetSystemTimeAsFileTime

user32

wsprintfW

advapi32

QueryServiceStatusEx OpenServiceW QueryServiceConfig2W QueryServiceConfigW EnumServicesStatusExW CreateServiceW CloseServiceHandle OpenSCManagerW DeleteService ControlService StartServiceW RegCreateKeyExW

shell32

SHGetFolderPathW SHGetSpecialFolderPathW

msvcp140

?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@O@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@F@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_N@Z ?imbue@?$basic_ios@DU?$char_traits@D@std@@@std@@QAE?AVlocale@2@ABV32@@Z ?classic@locale@std@@SAABV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPBD@Z _Cnd_destroy_in_situ _Cnd_broadcast _Mtx_unlock _Xtime_get_ticks _Query_perf_counter _Cnd_wait _Cnd_register_at_thread_exit _Mtx_init_in_situ ?__ExceptionPtrRethrow@@YAXPBX@Z ?__ExceptionPtrCurrentException@@YAXPAX@Z _Mtx_lock ?__ExceptionPtrDestroy@@YAXPAX@Z _Mtx_destroy_in_situ ?__ExceptionPtrToBool@@YA_NPBX@Z _Cnd_timedwait ?_Syserror_map@std@@YAPBDH@Z ?_XGetLastError@std@@YAXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Rethrow_future_exception@std@@YAXVexception_ptr@1@@Z ?_Throw_C_error@std@@YAXH@Z ?_Xbad_function_call@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z ?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z ?_Throw_future_error@std@@YAXABVerror_code@1@@Z _Query_perf_frequency ?__ExceptionPtrCopy@@YAXPAXPBX@Z _Cnd_init_in_situ ?__ExceptionPtrCreate@@YAXPAX@Z _Cnd_unregister_at_thread_exit _Mtx_current_owns ??0task_continuation_context@Concurrency@@AAE@XZ ?_CallInContext@_ContextCallback@details@Concurrency@@QBEXV?$function@$$A6AXXZ@std@@_N@Z ?_Reset@_ContextCallback@details@Concurrency@@AAEXXZ ?_Capture@_ContextCallback@details@Concurrency@@AAEXXZ ?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAEXXZ ?_Release_chore@details@Concurrency@@YAXPAU_Threadpool_chore@12@@Z ?_LogScheduleTask@_TaskEventLogger@details@Concurrency@@QAEX_N@Z ?_LogCancelTask@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogTaskCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogTaskExecutionCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogWorkItemStarted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_LogWorkItemCompleted@_TaskEventLogger@details@Concurrency@@QAEXXZ ?_Schedule_chore@details@Concurrency@@YAHPAU_Threadpool_chore@12@@Z ?_ReportUnobservedException@details@Concurrency@@YAXXZ ?GetCurrentThreadId@platform@details@Concurrency@@YAJXZ ?__ExceptionPtrAssign@@YAXPAXPBX@Z _Cnd_signal

shlwapi

PathFileExistsW

vcruntime140

__CxxFrameHandler3 __std_exception_copy _purecall wcsrchr __std_type_info_name __std_terminate wcschr __std_exception_destroy wcsstr strstr strchr _except_handler4_common _CxxThrowException memset memcpy __std_type_info_compare memmove memchr __RTtypeid _set_purecall_handler __RTDynamicCast

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment _configure_wide_argv _get_wide_winmain_command_line _set_app_type _seh_filter_exe _cexit _initterm _invalid_parameter_noinfo_noreturn _initterm_e _set_invalid_parameter_handler strerror_s _errno _crt_atexit _register_onexit_function _initialize_onexit_table terminate _c_exit _register_thread_local_exe_atexit_callback _controlfp_s exit _invalid_parameter_noinfo _exit _beginthreadex

api-ms-win-crt-time-l1-1-0

_mktime64 _time64 _localtime64

api-ms-win-crt-convert-l1-1-0

atoi wcstoul _itow_s _wtoi

api-ms-win-crt-heap-l1-1-0

calloc _callnewh realloc free malloc _set_new_mode

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s fclose fseek rewind fwrite fread __stdio_common_vsprintf_s __acrt_iob_func __stdio_common_vswprintf __stdio_common_vswscanf __p__commode ftell _set_fmode __stdio_common_vsprintf __stdio_common_vfprintf __stdio_common_vsnwprintf_s _wfopen_s

api-ms-win-crt-string-l1-1-0

_stricmp isspace wcscpy_s wcsncpy _wcsnicmp towlower towupper tolower _wcsicmp

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-filesystem-l1-1-0

_splitpath_s

api-ms-win-crt-math-l1-1-0

_except1 floor _finite _isnan ceil _dtest __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

2345SafeUpdate.exe

SHA256 685d9f34859c1081bb39afb2036e2e1dc6af6a4edf719bead766e29c8d3aeed3
MD5 eab77b8deaa4c7d8cb2d043d22d32255
SHA1 508e091b635773cb15a3e26630d8afb4b94ee93c
SHA512 9195f0165b45db340df3d2147a2e18013ac939cab28064b1d2f4a81fe70890dac8374dab4a149de75021b625d28e8b4e28bdcca7aebd2796855530b9504d7ac6
SSDEEP 12288:Z5/asKExekSv8fyIP6wQkm+AICsRkP34u0tLfkDj8kUeqvoI:ZlbKExeki8fyIP6hVICAArQSq7
TLSH
T1D8E40821A205C727D99541F0271C9E2B90587D3827A598C3F3C90F7A64F2ED76A3AF1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

833395

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

2345Setting.exe

IMPHASH cb5344d82fde25cd7095b11a61e003d8
SHA256 82a8ccaafa401e26fc2c9a3238a44eaa4e1d1bccd187955f8c68d819dd9234c0
MD5 1ef68b0d249ed7424a6c786fa932588e
SHA1 d22676022712ae0626826b44bd0e4cf50aacc1d7
SHA512 c9aea7c3a7e1ae547c41f84a824588a85b9863fec4feee56ba1e24a014a2e007fa48e9981600d031193d6bd9f804536bd97df036eb1671948468adc7deaaa851
SSDEEP 1536:1bIIIIJGUwTiZ49fflkhyIOiAxkhyIOiAOE798Qu76MlF7Al1q:VIIIIe1XlkhcxkhcOEqr7lFElw
TLSH
T1AD934B527AC3C8D9E456867114644A7EB0367E3F1F105ACF2780FB2165722C2BE77A2E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20798

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\pc-2345mpcsafe-build\Rhino\Safe\Bin\Win32\release\pdb\2345Setting.pdb

gdiplus

GdiplusShutdown GdiplusStartup

kernel32

user32

IsWindow ShowWindow SendMessageW IsWindowVisible GetWindowLongW SetForegroundWindow

msvcp140

?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z

vcruntime140

memmove memcpy __CxxFrameHandler3 memset _CxxThrowException __std_exception_destroy __std_exception_copy _except_handler4_common wcschr

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _seh_filter_exe terminate _controlfp_s _crt_atexit _register_onexit_function _initialize_onexit_table _set_app_type _register_thread_local_exe_atexit_callback _c_exit _cexit _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _exit exit _initterm_e _initterm

api-ms-win-crt-string-l1-1-0

towlower towupper

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode

api-ms-win-crt-math-l1-1-0

_except1 __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

2345ShellPro.exe

IMPHASH b7f5df6917b2d33b7f55be3b17d63944
SHA256 5a4ed357d4961081ee28d3a0a3b073e25ade5e8619e9f215a35f39bca15c5d6b
MD5 ebfb240e664ae917d1637d085ec19c9b
SHA1 9c215b43b2d05115318cf70210ba7e32bce34b15
SHA512 f6058bd7402e9d65f2be804cbc25093ed452b088e7d93d59be7982bbde71ed8ea23b1346a09c800118ed9fbf9e00bb20343c50cd7943db6b6509bb458f679c1e
SSDEEP 24576:x8JXZDWn1nqnD7gy0aMlQk424S77+cj8lES2g6YMI4TDMJuikXe0cNws+IL4gL0q:CJls8N0flQs+Ug6YMI4TQJuqwxIL4gLr
TLSH
T1C96528707646C22BE56101F0562C9F6A50547D392BA258CBF3C43F2EA8F1DD35A36E2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

966372

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\pc-2345mpcsafe-build\Rhino\Safe\Bin\Win32\release\pdb\2345ShellPro.pdb

version

VerQueryValueW GetFileVersionInfoSizeW GetFileVersionInfoW

shlwapi

PathIsNetworkPathW PathAppendW PathFileExistsW PathRemoveFileSpecW

crypt32

CryptMsgClose CertFreeCertificateContext CryptQueryObject CertCloseStore CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW

psapi

GetModuleFileNameExW

kernel32

OpenMutexW HeapFree InterlockedDecrement GetProcAddress GetProcessHeap GetModuleHandleW InterlockedIncrement MoveFileExW GetPrivateProfileStringW GetTempPathW CreateFileW FileTimeToSystemTime LocalFree GetUserDefaultLangID WriteFile SetFilePointer GetCurrentThreadId GetLocalTime QueryDosDeviceW GetEnvironmentVariableW GetLogicalDriveStringsW VirtualQuery GetModuleHandleExW ReleaseMutex GetCurrentProcessId MoveFileW InitializeCriticalSectionAndSpinCount ReadFile SetEndOfFile GetFileSize GetComputerNameW GetTickCount SetEvent lstrlenW InterlockedExchange InterlockedExchangeAdd SetLastError LockResource GlobalMemoryStatusEx FreeLibrary ExpandEnvironmentStringsW GetVersionExW GetCurrentProcess GetFileAttributesW UnhandledExceptionFilter GetFileAttributesExW OpenFileMappingW UnmapViewOfFile CreateFileMappingW MapViewOfFile SearchPathW TerminateProcess GetSystemInfo CreateProcessW CloseHandle GetLastError Sleep OpenProcess WaitForSingleObject CreateMutexW WaitForMultipleObjects DeleteFileW GetModuleFileNameW CreateEventW ResetEvent GetExitCodeProcess GetACP MultiByteToWideChar WideCharToMultiByte SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime IsDebuggerPresent GetStartupInfoW OutputDebugStringW FormatMessageW DeviceIoControl GetTempFileNameW CopyFileW GetWindowsDirectoryW GetCurrentDirectoryW SetFileAttributesW RemoveDirectoryW GetFullPathNameW CreateDirectoryW GetFileSizeEx ResumeThread LoadResource FindResourceW lstrcmpiW GetVolumeInformationW GetDiskFreeSpaceW GetDriveTypeW FindFirstFileW GetLongPathNameW LoadLibraryW FindClose FindNextFileW GetFileTime SetFileTime HeapAlloc GlobalFree GlobalAlloc DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection InitializeSListHead EnterCriticalSection LoadLibraryExW

user32

wsprintfW SetForegroundWindow IsWindow ShowWindow SendMessageW IsWindowVisible GetWindowLongW

advapi32

RegCreateKeyExW CreateServiceW QueryServiceStatus CloseServiceHandle OpenSCManagerW ChangeServiceConfig2W DeleteService ControlService StartServiceW OpenServiceW

shell32

ShellExecuteW SHChangeNotify SHGetSpecialFolderPathW SHGetFolderPathW SHGetPathFromIDListW

ole32

CoCreateInstance

msvcp140

?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?tolower@?$ctype@D@std@@QBEPBDPADPBD@Z ?tolower@?$ctype@D@std@@QBEDD@Z ??1facet@locale@std@@MAE@XZ ??0facet@locale@std@@IAE@I@Z ?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UAEXXZ ??Bid@locale@std@@QAEIXZ ??1_Facet_base@std@@UAE@XZ ?_Getcoll@_Locinfo@std@@QBE?AU_Collvec@@XZ ??1_Locinfo@std@@QAE@XZ ??0_Locinfo@std@@QAE@PBD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ _Strcoll ??_7facet@locale@std@@6B@ ?id@?$collate@D@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xbad_alloc@std@@YAXXZ ?_Init@locale@std@@CAPAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ??0_Lockit@std@@QAE@H@Z ??1_Lockit@std@@QAE@XZ _Strxfrm ??_7_Facet_base@std@@6B@ ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UAE@XZ ?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEXABVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAN@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sync@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEHXZ ?setbuf@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEPAV12@PA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPB_W_J@Z ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JPA_W_J@Z ?uflow@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAEGXZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MAE_JXZ ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UAE@XZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAE@PAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?_Pninc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAEPA_WXZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IAE@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IAE@XZ ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAEG_W@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QAEXH_N@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QAE_JPB_W_J@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@XZ ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEXXZ ?_Xlength_error@std@@YAXPBD@Z ?_Xout_of_range@std@@YAXPBD@Z ?uncaught_exception@std@@YA_NXZ ?id@?$ctype@D@std@@2V0locale@2@A

vcruntime140

__std_type_info_name __CxxFrameHandler3 __std_exception_copy strchr wcsrchr _purecall wcschr wcsstr strstr __std_exception_destroy _except_handler4_common _CxxThrowException memset memmove memcpy memchr

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vswprintf _set_fmode __stdio_common_vswprintf_s fclose fputws _wfopen ftell __stdio_common_vsprintf_s __stdio_common_vsprintf __stdio_common_vswscanf fopen __stdio_common_vsscanf fseek fwrite rewind _wfopen_s fread

api-ms-win-crt-environment-l1-1-0

_wsearchenv_s

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _register_thread_local_exe_atexit_callback _c_exit _cexit _exit exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _crt_atexit _invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn _controlfp_s _beginthreadex _errno terminate

api-ms-win-crt-heap-l1-1-0

malloc calloc free realloc _set_new_mode _callnewh

api-ms-win-crt-convert-l1-1-0

atoi _wtoi wcstoul

api-ms-win-crt-locale-l1-1-0

_configthreadlocale setlocale

api-ms-win-crt-string-l1-1-0

isalnum _wcsicmp _wcsnicmp towlower towupper wcsncpy tolower _stricmp

api-ms-win-crt-time-l1-1-0

_mktime64 _time64 _localtime64_s _localtime64

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-filesystem-l1-1-0

_splitpath_s

api-ms-win-crt-math-l1-1-0

_dtest modf __setusermatherr _except1

2345SysDoctor.exe

IMPHASH 9e18128b125ba25cf6c1c0d3cacdaffd
SHA256 b5277b0a99b973cd6a78f39315fbbebb050dc0715a15e10228dc030c29b6f224
MD5 86f10794d18f0d770da5e1aa08e917ad
SHA1 fa21686a6e86b28c5a682cb19a5b417b598570a8
SHA512 4adf7ba56f864ada179f710dcb01cb45caf5a0904f5fdfd88f61419af8a65a13829430f28a32f8799b9f0053af9313a2132f5b957f555d9ca9b782dd7050df03
SSDEEP 1536:KbIIIIjdNr746D1MFhFV5MpfzfUVhFV5MpfzfU4+6d76MlC67AlJ9:KIIIIjLjD6Fhurfkhurfb+i7lJElf
TLSH
T13F837C317AD29055C8C1C5B01A385A6A75B2BD5F2B416ECF174CBD327A727C2A63132E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\pc-2345mpcsafe-build\Rhino\Safe\Bin\Win32\release\pdb\2345SysDoctor.pdb

gdiplus

GdiplusStartup GdiplusShutdown

kernel32

msvcp140

?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z

vcruntime140

_CxxThrowException memmove __CxxFrameHandler3 wcschr _except_handler4_common __std_exception_copy __std_exception_destroy memset memcpy

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

towlower towupper

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh malloc

api-ms-win-crt-math-l1-1-0

_except1 __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

2345Uninst.exe

IMPHASH c552a31531df962b2298e689961d15c2
SHA256 33dd1091105b1edd7ee274304d4c2d6a3da794512fc33b5229165cba420fe949
MD5 5af40b1378fcc32f5ea86941aad7d459
SHA1 2371ef1d6fa8693e85c3e94ce8cc2fee54bd62b0
SHA512 526e5fa84e6b6f7611e11e15115a053bddf86d92d44b3facc41eb54e1d371f6b79ec166a16d08cc4eccf2d1ce0638ca5b4c73960b66cf8cc0dc33b7ecae3ab72
SSDEEP 49152:fQPgubnRDwgr2RXE25T6krvjeYEY3wFKbtDd4+k1:+bnduRXlp6kveOgFK9E
TLSH
T10A85F1E15D62B065E217047728D02CC7AE213DADE7416A7B0BC5B733AD23526FB2721B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

user32

gdi32

SetBkColor GetDeviceCaps SetTextColor SetBkMode SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW

shell32

ShellExecuteExW SHBrowseForFolderW SHGetPathFromIDListW SHGetFileInfoW SHFileOperationW SHGetSpecialFolderLocation

advapi32

comctl32

ImageList_Create ImageList_Destroy ImageList_AddMasked ord17

ole32

OleUninitialize OleInitialize CoCreateInstance CoTaskMemFree

$PLUGINSDIR/FileInfo.dll

IMPHASH 24dba5f7faae071e4de747a3d14d4a2b
SHA256 fe577e6af8fd32d800d292d12e02358359fda97b9a376b60c20453798003a50a
MD5 db196b83cd9fbfceaaa3e5560f0a187d
SHA1 de234f418cef7ff87dc5737dbb8423eac51306e2
SHA512 0468911a356f11faeea256f6e6d8ea70ff2ea4adf8f3e041eab86dbeec882823c8f0d00f747a3477c3d877106cfa90d8c1e6059cb0cb52671ce155dd84af91fe
SSDEEP 24576:zPt6/WIZSALHQZWhIuO1EY28XTvO0ONVBz87VtiqC:z0WtAzhhOdXTGBvBz87VtiqC
TLSH
T162455C116286C277E55E01B01B2D9E7E506C75302B6088CBF7C46F6EA9F0DD29632EE7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

a1:08:f3:51:6d:a2:1e:2e:28:2c:e7:d5:b1:65:dd:8e:32:24:78:ef:8d:e6:84:79:0b:c9:fb:ed:55:09:b8:36

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

Chains

Nov 14, 2023

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

4a:c0:4d:74:e1:6f:ce:e7:8b:45:a1:de:ee:bd:f3:96:b6:c7:96:73

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Nov 14, 2023

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

Serial Number

0d:7e:f8:80:11:79:bf:12:a7:46:6f:7d:a5:b3:27:7a

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 28, 2023 - Jul 7, 2026

Minor OS version

Major OS version

Entry point

749634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\C++\Safe\Rhino\Safe\Install\FileInfo\Bin\Win32\release_static\pdb\FileInfo.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

kernel32

advapi32

RegCloseKey RegFlushKey RegCreateKeyExW RegSetValueExW

shell32

SHChangeNotify ShellExecuteW SHGetFolderPathW SHGetPathFromIDListW SHGetSpecialFolderPathW

ole32

CoCreateInstance

oleaut32

SysAllocString VariantClear

shlwapi

PathIsNetworkPathW PathIsRootW PathAddBackslashW PathFileExistsW

$PLUGINSDIR/RCWidgetPlugin.dll

IMPHASH ae8510b68862e16e1c4b71f50fa99067
SHA256 a6389a33c27b1ca3579b123781cb28f11336861bb2435d9e5906e942f1cc37d2
MD5 06804039ba720dbb60232aff87ddf0d0
SHA1 1bb0b48c816271701e0e237998da27634e3b44ac
SHA512 7b203977d6794886130b72881c1e219c1a47cbc3eba11d2e62fbab34ea9f3b2ed9c7e8fd08768e1476a56069270a4046c93796be992df82c0c0e324e2d0d4795
SSDEEP 49152:8X3z9pQajjCWDrSRKtGRZuSJDpU0Yo3oEdOT9SUh/1PgTQPNICAk4doPd1:8HzbPn/BcpVU0YOooPQ3
TLSH
T1E3F59E11B7828172E68E0172166D9AAF44783E14076548DBA3C83F3FAE715E3773BA17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

73:10:e5:55:84:b9:61:81:8c:9e:27:76:b1:19:bb:7a:74:10:35:54:3a:fb:85:b2:71:50:96:70:05:bf:52:ba

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

Chains

Oct 28, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Digest

e0:73:62:c3:bd:62:c9:c4:ad:84:85:08:ea:bb:fb:cd:79:74:14:9e

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

Chains

Oct 28, 2024

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

Serial Number

0d:7e:f8:80:11:79:bf:12:a7:46:6f:7d:a5:b3:27:7a

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 28, 2023 - Jul 7, 2026

Minor OS version

Major OS version

Entry point

1997138

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\CPP\Safe\Rhino\Safe\Install\RCSetup\Bin\Win32\release_static\pdb\RCWidgetPlugin.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

ws2_32

kernel32

user32

advapi32

RegQueryInfoKeyW RegDeleteKeyW RegEnumKeyExW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW QueryServiceStatus CloseServiceHandle OpenSCManagerW StartServiceW OpenServiceW RegCloseKey

ole32

CoCreateInstance CoTaskMemFree CoTaskMemRealloc CreateStreamOnHGlobal CoTaskMemAlloc OleUninitialize StringFromGUID2 CLSIDFromProgID CLSIDFromString OleLockRunning CoGetClassObject OleInitialize

shell32

DragQueryFileW SHGetFolderPathW SHGetSpecialFolderPathW SHGetPathFromIDListW SHBrowseForFolderW DragFinish

oleaut32

SysAllocStringLen SysStringLen DispCallFunc VarUI4FromStr LoadTypeLi VariantInit LoadRegTypeLi SysAllocString VariantClear OleCreateFontIndirect SysFreeString

shlwapi

PathFindFileNameW ord12 StrToIntA PathAppendW StrDupW

comctl32

InitCommonControlsEx _TrackMouseEvent

gdi32

msimg32

AlphaBlend

urlmon

CoInternetCreateZoneManager CoInternetCreateSecurityManager

imm32

ImmNotifyIME ImmAssociateContextEx ImmGetContext ImmSetCompositionWindow ImmReleaseContext ImmGetCompositionStringW

gdiplus

winmm

timeGetTime

psapi

GetMappedFileNameW

generic

count=27, id=241, version=40116,

count=166, id=243, version=40116,

count=35, id=242, version=40116,

count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,

count=2, productName=Unmarked objects (old),

count=3, id=260, productName=VS2017 v15.9.5 build 27026, version=27026,

count=31, id=259, version=26706,

count=12, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=123, id=261, version=26706,

count=36, id=260, version=26706,

count=2, id=260, version=27035,

count=61, id=261, version=27035,

count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,

count=688, id=1, productName=Unmarked objects,

count=283, id=265, version=27051,

count=1, id=256, version=27051,

count=1, id=255, version=27051,

count=1, id=151,

count=1, id=258, version=27051,

$PLUGINSDIR/System.dll

IMPHASH 216ff05c01e38b13fee53b7ace6b1894
SHA256 0b399864057723bd388f8924baca252f8ca582287f5862460d042bfb8d2f11bc
MD5 219b2454333b6a78e6a365bbaab66321
SHA1 44224f5bea0d9b1d39da783273277e2750c81444
SHA512 5e87a00c7dd23d26c7287c5d082721d37893a6408adcd9dda272499143e5cbe84177d62c611131f7b4e242693510d658630ebb3721007758cc9eb348d5282e39
SSDEEP 384:HxoXlBT3SaMINWf52+4kb1VYnYPLYZJzk/holCZsHL0Fu8JN77hh1nY:HypSvIWb3J2iClfC3hbY
TLSH
T144D25C42AB651CF2FAD68E3930E4F52B5D30B7D067D1C8E756A9C4406FC17D229B818E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

e2:2a:29:61:3d:2e:db:f3:c1:d8:06:ab:50:62:3e:3c:ce:8a:52:6d:8c:a2:53:79:ce:9c:25:cb:c3:dd:a4:98

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

Chains

Jul 14, 2020

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

PE Signature issue

Digest

01:ff:77:6e:f8:da:13:72:ac:88:d1:3e:ed:4e:11:10:e9:9f:01:22

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

Chains

Jul 14, 2020

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

Serial Number

06:ea:0d:de:d5:5e:c1:e1:a2:9f:c5:fb:5d:ab:4f:b2

Issuer

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2020 - May 18, 2023

Subject

CN=DigiCert EV Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0d:d0:e3:37:4a:c9:5b:db:fa:6b:43:4b:2a:48:ec:06

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

Serial Number

05:aa:43:30:0d:17:67:ac:12:49:43:54:21:65:bb:9e

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2020 - May 18, 2023

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 18, 2012 - Apr 18, 2027

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

7584

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Uninstall.exe

IMPHASH a4b360bddf6debaead62ef5dd53fa103
SHA256 0f296a94a24981dc3996e2828640bee03ce8b51e0c61921c241d03d856068c8e
MD5 71ac6059d05d4d1ba95061d43e822454
SHA1 b216a57b8d8d67bcf2d8bd8cef29feff22dda2fc
SHA512 b5fe461edf546853a7625420a5250610635b5a939b77ab1ba99ac176f9424c6875098d198d2217a36e0326eba28bf4c340656afe846e072f88739a55d4c5aaa7
SSDEEP 24576:gT5qiIDoCzCB3E7rlYAvgazzKDZvTTNYOSfKX:g93Cg3yYcgfZvTRYKX
TLSH
T12A152920BA4AC337D15101B0176CAF7A90647A392F6008C7B3C51F6AA4B5ED76E36F5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

634512

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\pc-2345mpcsafe-build\Rhino\Safe\Bin\Win32\release\pdb\Uninstall.pdb

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

crypt32

CryptMsgClose CertFreeCertificateContext CryptQueryObject CertCloseStore CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW

kernel32

HeapAlloc GetProcAddress LocalFree GetCurrentProcessId GetProcessHeap GetModuleHandleW FreeLibrary CreateFileW FileTimeToSystemTime FileTimeToLocalFileTime WriteFile GetModuleFileNameW SetFilePointer GetCurrentThreadId GetLocalTime CreateFileMappingW QueryDosDeviceW GetEnvironmentVariableW GetLogicalDriveStringsW VirtualQuery ReadFile SetEndOfFile Sleep DeleteFileW GetFileSize WaitForMultipleObjects CloseHandle SetEvent GetTickCount InterlockedExchange SetLastError InterlockedExchangeAdd lstrlenW GetPrivateProfileStringW GlobalMemoryStatusEx ExpandEnvironmentStringsW GetVersionExW OpenProcess GetFileAttributesW lstrcmpiW FindResourceW LoadResource GetSystemInfo LockResource CreateProcessW ResetEvent CreateEventW MapViewOfFile UnmapViewOfFile OpenFileMappingW GetCurrentProcess HeapFree GetUserDefaultLangID GetLastError GetTempPathW LoadLibraryW LoadLibraryExW CreateMutexW ReleaseMutex WaitForSingleObject GetFileAttributesExW GetLongPathNameW DeviceIoControl GetFileSizeEx FormatMessageW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetCurrentDirectoryW GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW SetFileAttributesW GetFullPathNameW WideCharToMultiByte CreateDirectoryW GetFileTime InitializeCriticalSectionAndSpinCount SetFileTime ResumeThread FindClose FindNextFileW MultiByteToWideChar GetACP DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection FindFirstFileW

advapi32

RegCreateKeyExW

shell32

SHGetFolderPathW SHGetSpecialFolderPathW

msvcp140

?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ

vcruntime140

_CxxThrowException memset _except_handler4_common __std_exception_copy __std_exception_destroy memmove strstr memcpy __CxxFrameHandler3 wcsstr wcschr _purecall wcsrchr memchr

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _invalid_parameter_noinfo _errno _initialize_onexit_table _controlfp_s terminate _register_onexit_function _register_thread_local_exe_atexit_callback _c_exit _exit exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _beginthreadex

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s _wfopen_s __p__commode ftell fclose __stdio_common_vswscanf __stdio_common_vswprintf _set_fmode fseek rewind fwrite fread __stdio_common_vsprintf

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi atoi

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free malloc calloc

api-ms-win-crt-time-l1-1-0

_time64 _mktime64 _localtime64

api-ms-win-crt-utility-l1-1-0

srand rand

api-ms-win-crt-string-l1-1-0

_wcsicmp towupper _wcsnicmp towlower wcsncpy tolower _stricmp

api-ms-win-crt-filesystem-l1-1-0

_splitpath_s

api-ms-win-crt-math-l1-1-0

_dtest _except1 __setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale